hunt-session

Testing for session fixation requires simulating two real sessions, an attacker and a victim, to verify if the login flow regenerates the session ID. You validate persistence by checking whether the application invalidates old identifiers after authentication.

Using JWT for session management introduces risks if tokens lack exp claims or revocation mechanisms. You must assess token entropy and insufficient invalidation during logout and password changes to prevent persistent unauthorized access.

Validating OAuth refresh token rotation requires testing SSO flows to confirm the server detects replay attacks. You apply body-diff verification across two sessions to ensure stolen tokens are invalidated upon reuse.

Yes, this approach tests device-bound sessions by attempting downgrades against DBSC implementations. It verifies cookie attribute hardening, ensuring flags like HttpOnly and Secure prevent cross-session theft risks.

Mapping session management findings to OWASP WSTG involves aligning discovered fixation and invalidation weaknesses with standard testing guides. You document persistent cross-session risks and specify concrete remediation practices for secure coding.