skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-session

Detects session fixation, invalidation failures, weak ID entropy via dual-session comparative analysis using curl and jq.

3|1|Updated Jul 2, 2026
Search Tags:#security#authentication#session#pentest#ato#offsec
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-session-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-session
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-session
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-session-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses critical session management vulnerabilities that lead to Account Takeover (ATO), such as session fixation, insufficient invalidation, and predictable session identifiers.

Core Features & Use Cases

  • Session Fixation Testing: Detects if servers fail to regenerate session IDs upon authentication.
  • Invalidation Verification: Confirms if sessions are properly destroyed after logout, password changes, or email updates.
  • Entropy & Attribute Analysis: Evaluates session ID randomness and checks for secure cookie attributes like HttpOnly and SameSite.

Quick Start

Use the hunt-session skill to perform a two-session validation test on the target application to identify potential session fixation and invalidation flaws.

Frequently Asked Questions about hunt-session

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for session fixation vulnerabilities during a pentest?▼

Session fixation testing validates whether a web server fails to regenerate session IDs upon authentication. This skill performs a two-session comparative analysis to detect if pre-authentication session tokens remain valid post-login, exposing account takeover risks.

How do I verify session invalidation after logout or password changes?▼

Session invalidation verification confirms whether active sessions are properly destroyed after logout, password changes, or email updates. This skill executes multi-session body-diff verification to identify tokens that remain persistently active when they should be invalidated.

How do I check session ID entropy and cookie security attributes?▼

Session ID entropy analysis evaluates the randomness of generated tokens to prevent predictable identifiers. This skill also inspects cookie security hardening by checking for HttpOnly and SameSite attributes to mitigate client-side interception and cross-site request forgery.

Can I use curl and jq for session management security assessments?▼

Yes, this session management security assessment requires bash-compatible environments with curl and jq. These dependencies are necessary to execute the multi-session comparative analysis and perform body-diff verification against the target web application.

What is the best way to prevent account takeover through weak authentication persistence?▼

Preventing account takeover through weak authentication persistence requires validating token rotation and session fixation flaws. This skill identifies improper invalidation and weak session ID entropy to harden authentication persistence against unauthorized access.

Related Skills

Explore More Software Engineering Skills→
legoutlegout
3

marimo-pair

Execute code and manage cells in running marimo notebook kernels via HTTP API.

Community
Advanced
uphiagouphiago
1.1k

hunt-session

...

Community
Advanced
Bsh13lderBsh13lder
4

security-arsenal

Supply security professionals with payloads and bypass techniques for web application vulnerability testing.

Community
Advanced
bpnrockstarbpnrockstar

hunt-session

Identify and validate session management vulnerabilities in web applications.

Community
Advanced