{
  "slug": "session-management-testing",
  "title": "Session Management Testing",
  "phase": "Exploitation",
  "description": "Test the session lifecycle for weak token entropy, insecure cookie attributes, session fixation, incomplete invalidation, timeout flaws, and remember-me weaknesses.",
  "difficulty": "medium",
  "tags": [
    "exploitation",
    "session-management",
    "cookies",
    "session-fixation",
    "samesite"
  ],
  "tools": [
    "burpsuite",
    "curl",
    "jwt_tool"
  ],
  "steps": [
    {
      "id": "session-01",
      "title": "Analyse session token generation and entropy",
      "description": "Collect a large sample of session tokens and evaluate their randomness and predictability.",
      "commands": [
        "for i in $(seq 1 20); do curl -sI https://target.com/login -X POST -d 'user=x&pass=y' | grep -i 'set-cookie'; done"
      ],
      "notes": "Watch for tokens that encode a username, incrementing counter, or Unix timestamp. If the token is a JWT or base64 blob, decode it before assuming it is opaque."
    },
    {
      "id": "session-02",
      "title": "Check cookie security attributes",
      "description": "Verify that session cookies carry HttpOnly, Secure, an appropriate SameSite value, and a tightly scoped Domain and Path.",
      "commands": [
        "curl -sI https://target.com/login -X POST -d 'user=x&pass=y' | grep -i 'set-cookie'"
      ],
      "notes": "A missing HttpOnly flag turns any XSS into session theft. A Domain scoped to a shared parent like .target.com leaks the cookie to every subdomain, including ones you may control via subdomain takeover."
    },
    {
      "id": "session-03",
      "title": "Test for session fixation",
      "description": "Check whether the session identifier issued before authentication is rotated after a successful login.",
      "commands": [
        "curl -sI https://target.com/ | grep -i 'set-cookie'",
        "curl -si https://target.com/login -X POST -b 'SESSIONID=attacker-fixed-value' -d 'user=victim&pass=victim' | grep -i 'set-cookie'"
      ],
      "notes": "If the post-login response does not issue a fresh Set-Cookie, the session ID is not rotated and fixation is possible. Test both cookie-based and URL-parameter session identifiers."
    },
    {
      "id": "session-04",
      "title": "Test session invalidation on logout and password change",
      "description": "Confirm that logging out and changing the password server-side invalidate all existing session tokens.",
      "commands": [
        "curl -si https://target.com/account -b 'SESSIONID=old-token-after-logout' | head -n 1"
      ],
      "notes": "A token that still works after logout or after a password change is a real finding, especially for account-takeover recovery flows. Test that other devices are logged out when the password changes."
    },
    {
      "id": "session-05",
      "title": "Test concurrent sessions and timeouts",
      "description": "Assess concurrent-session handling and both idle and absolute session timeouts.",
      "commands": [
        "curl -si https://target.com/account -b 'SESSIONID=idle-token' | head -n 1"
      ],
      "notes": "Note the exact idle and absolute lifetimes. A session that never expires, or an absolute timeout measured in months, is worth reporting on high-value applications such as banking or admin panels."
    },
    {
      "id": "session-06",
      "title": "Test remember-me and persistent tokens",
      "description": "Evaluate the strength, storage, and revocation of long-lived remember-me tokens.",
      "commands": [
        "curl -si https://target.com/login -X POST -d 'user=x&pass=y&remember=1' | grep -i 'set-cookie'",
        "jwt_tool <remember-token> -T"
      ],
      "notes": "Remember-me tokens are often weaker than session cookies. Check that they are single-use or rotated, tied to a server-side record, and revoked on password change and logout."
    },
    {
      "id": "session-07",
      "title": "Verify CSRF token binding to the session",
      "description": "Confirm that anti-CSRF tokens are cryptographically bound to the user's session and cannot be reused across accounts.",
      "commands": [
        "curl -si https://target.com/account/email -X POST -b 'SESSIONID=userB' -d 'csrf=tokenFromUserA&email=x@x.com' | head -n 1"
      ],
      "notes": "A CSRF token accepted regardless of the session it was issued to provides no protection. Also test whether removing the token entirely, or supplying an empty value, is accepted."
    }
  ],
  "references": [
    "https://portswigger.net/web-security/csrf",
    "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/",
    "https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html",
    "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html",
    "https://portswigger.net/web-security/essential-skills/obfuscating-attacks-using-encodings"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-07-05"
}