Session Management Detection
Detection Workflow
- Identify session operations: Find session creation code, locate session validation checks, identify session destruction, map session lifecycle
- Analyze session ID generation: Review session ID generation algorithm, check randomness and entropy, assess predictability, test for collision resistance
- Check transmission security: Verify SSL/TLS usage, check for session ID in URLs, assess cookie security flags, review transmission methods
- Assess session lifecycle: Verify session expiration, check logout behavior, assess session invalidation, review concurrent session handling
Key Patterns
- Session fixation: predictable session IDs, session IDs not regenerated after login, accepting attacker-provided session IDs, weak session ID generation
- Session hijacking: session IDs exposed in URLs, session IDs transmitted insecurely, missing SSL/TLS, weak session ID entropy
- Session timeout issues: missing session expiration, excessive session timeout, no session invalidation on logout, persistent sessions across devices
- Cookie security: missing HttpOnly flag, missing Secure flag, cookie accessible via JavaScript, cookie path/domain misconfiguration
Output Format
Report with: id, type, subtype, severity, confidence, location, vulnerability, session_generation (method, predictability, entropy), attack_scenario, bypass_steps, exploitable, impact, mitigation.
Severity Guidelines
- CRITICAL: Session fixation allowing account takeover
- HIGH: Session hijacking with weak session IDs
- MEDIUM: Excessive session timeout or missing logout
- LOW: Minor cookie security issues
See Also
patterns.md - Detailed detection patterns and exploitation scenariosexamples.md - Example analysis cases and code samplesreferences.md - CWE references and mitigation strategies
1---2name: analyzing-session-management3description: Detects session management vulnerabilities including session fixation, session hijacking, and insecure cookie handling. Use when analyzing authentication sessions, cookie security, or investigating session-related vulnerabilities.4---5
6# Session Management Detection
7
8## Detection Workflow
9
101. **Identify session operations**: Find session creation code, locate session validation checks, identify session destruction, map session lifecycle
112. **Analyze session ID generation**: Review session ID generation algorithm, check randomness and entropy, assess predictability, test for collision resistance
123. **Check transmission security**: Verify SSL/TLS usage, check for session ID in URLs, assess cookie security flags, review transmission methods
134. **Assess session lifecycle**: Verify session expiration, check logout behavior, assess session invalidation, review concurrent session handling
14
15## Key Patterns
16
17- Session fixation: predictable session IDs, session IDs not regenerated after login, accepting attacker-provided session IDs, weak session ID generation
18- Session hijacking: session IDs exposed in URLs, session IDs transmitted insecurely, missing SSL/TLS, weak session ID entropy
19- Session timeout issues: missing session expiration, excessive session timeout, no session invalidation on logout, persistent sessions across devices
20- Cookie security: missing HttpOnly flag, missing Secure flag, cookie accessible via JavaScript, cookie path/domain misconfiguration
21
22## Output Format
23
24Report with: id, type, subtype, severity, confidence, location, vulnerability, session_generation (method, predictability, entropy), attack_scenario, bypass_steps, exploitable, impact, mitigation.
25
26## Severity Guidelines
27
28- **CRITICAL**: Session fixation allowing account takeover
29- **HIGH**: Session hijacking with weak session IDs
30- **MEDIUM**: Excessive session timeout or missing logout
31- **LOW**: Minor cookie security issues
32
33## See Also
34
35- `patterns.md` - Detailed detection patterns and exploitation scenarios
36- `examples.md` - Example analysis cases and code samples
37- `references.md` - CWE references and mitigation strategies
aibot88