hunt-session

Capture a pre-authentication session cookie with curl, authenticate while carrying that same cookie, then compare the session value before and after login. If the value is unchanged and now returns authenticated data, the server failed to regenerate the session and fixation is confirmed.

Log in twice to create sessions A and B, change the password using session B, then replay session A against an authenticated endpoint. If session A still returns the account's unique data in the response body, the old session survived and persistent account takeover is possible.

Rotation means each refresh request returns a new refresh token, and reuse detection means replaying an old token invalidates the entire token family. Test by rotating once, replaying the old token, and checking whether the new token still works afterward.

NIST SP 800-63B requires at least 64 bits of entropy in a session identifier. Collect 200 or more samples, check for duplicates, sequential patterns, and decodable structures like timestamps or user IDs rather than judging by token length alone.

Cached edge responses or generic SPA shells return 200 for everyone, so status codes alone prove nothing. Always diff the response body against the authenticated baseline for unique identity markers and run a garbage-cookie negative control to confirm the endpoint is session-gated.

A missing HttpOnly attribute is only a meaningful finding when chained to a real XSS or DOM sink that can actually read document.cookie. Standalone attribute gaps for HttpOnly, Secure, or SameSite are Low or Informational severity until paired with an exploit primitive.