testing-session-management-flaws

Capture the session cookie before authenticating, log in while sending that same cookie, then compare the post-login value. If the identifier does not rotate on authentication, an attacker can plant a known value on a victim and hijack their authenticated session.

Capture a valid session cookie, change the account password from a second browser or session, then replay the original cookie against a protected endpoint. An HTTP 200 response means old sessions survive the reset, which is a critical finding for compromised-credential scenarios.

Burp Suite Professional provides the proxy, Repeater for replay, and Sequencer for token randomness analysis across thousands of samples. curl or httpie handle manual cookie crafting and cross-IP replay, while browser DevTools inspect cookie flags, scope, and expiry.

Mutate one byte at a time in the token and replay it to identify which positions are actually validated, revealing the effective secret length. For statistical randomness, capture 5,000 or more freshly issued tokens in Burp Sequencer and analyze effective entropy bits.

Without HttpOnly, JavaScript can read the session cookie via document.cookie, so any reflected or stored XSS payload can exfiltrate it. This enables full account takeover without needing the victim's credentials.

Only test with written authorization for the target application, as replaying and tampering with sessions constitutes active exploitation. It is out of scope for production systems without a signed penetration testing agreement or bug bounty program coverage.