What problem does it solve? Session management flaws like session fixation, missing invalidation on logout or password change, and non-rotating refresh tokens enable persistent account takeover, yet they are tedious to test manually and easy to get wrong with false positives. ## Core Features & Use Cases - Lifecycle Invalidation Testing: Verify sessions are killed on logout, password change, and email change using a two-session (attacker/victim) methodology with body-diffing and negative controls. - Fixation & Entropy Analysis: Detect session IDs that are not regenerated on login, accept attacker-forced values, or are predictable/low-entropy per NIST SP 800-63B. - Token & Cookie Hardening Checks: Audit JWT-as-session expiry/revocation, refresh-token rotation and reuse-detection, cookie attributes (HttpOnly/Secure/SameSite/__Host-), and DBSC downgrade. - Use Case: During a bug bounty engagement, capture a session, have the test account change its password, then replay the old session against /api/profile — if it still returns account data, you have a persistent account-takeover finding. ## Quick Start Test the target application's session management by checking whether the session token is invalidated after logout and password change using the two-session curl methodology.
