What problem does it solve? Web application session management flaws are the most common path to account takeover, yet testers often miss critical checks like token renewal on login, server-side logout invalidation, or cookie attribute misconfigurations. This Skill provides the complete OWASP WSTG v4.2 session management methodology so penetration testers systematically cover all nine WSTG-SESS test cases. ## Core Features & Use Cases - Full WSTG-SESS Coverage: Step-by-step procedures for session schema analysis, cookie attributes, session fixation, exposed session variables, CSRF, logout, timeout, session puzzling, and session hijacking. - Concrete Test Procedures: Each test case includes objectives, hands-on testing steps, what to look for, and remediation guidance aligned with OWASP recommendations. - Use Case: During a web application penetration test, use this Skill to verify whether session tokens are renewed after authentication (WSTG-SESS-03), then confirm the logout function invalidates sessions server-side by re-injecting the old cookie (WSTG-SESS-06). ## Quick Start Use the wstg-session-management skill to test whether this application's session cookie is renewed after login and whether the old session remains valid after logout.
