What problem does it solve? Session management flaws like fixation, missing logout invalidation, and unrotated refresh tokens enable persistent account takeover, yet they are hard to prove without rigorous two-session testing and false-positive discipline. ## Core Features & Use Cases - Lifecycle Invalidation Testing: Verify sessions are killed on logout, password change, and email change using real attacker/victim session pairs captured via curl cookie jars. - Fixation & Entropy Analysis: Detect session IDs not regenerated on login, attacker-forced session values, and predictable or low-entropy identifiers through large-sample statistical analysis. - Token & Cookie Hardening Review: Audit refresh-token rotation and reuse-detection, JWT-as-session expiry/revocation, DBSC downgrade, and Secure/HttpOnly/SameSite/__Host- cookie attributes. - Use Case: During a bug bounty engagement, capture a test account's session, change its password from a second session, then replay the old cookie against /api/me — if it still returns user data, you have proven a persistent account-takeover finding. ## Quick Start Test whether the target's session is invalidated after logout and password change using the two-session curl methodology.
