What problem does it solve? Session management flaws like fixation, missing rotation, and improper revocation are hard to confirm without false positives. This Skill provides a disciplined, evidence-gated workflow to verify whether cookie and token lifecycle controls are actually enforced by the server. ## Core Features & Use Cases - Lifecycle Verification: Tests login, logout, password change, and permission change events to confirm old sessions are invalidated or rotated server-side. - Fixation & Revocation Checks: Runs controlled fixation and rotation comparisons using only your own test accounts and profiles. - False-Positive Filtering: Treats WAF blocks, captchas, timeouts, and client-side cookie observations as inconclusive, requiring server-side oracles for valid findings. - Use Case: During an authorized web app assessment, verify that changing a password actually kills existing sessions on other devices, with a full evidence timeline for the report. ## Quick Start Use $hunt-session to plan an evidence-gated, authorized validation of the target application's session lifecycle.
