analyzing-session-management
Detects session management vulnerabilities including session fixation, session hijacking, and insecure cookie handling. Use when analyzing authentication sessions, cookie security, or investigating session-related vulnerabilities.
When & Why to Use This Skill
This Claude skill automates the detection of critical session management vulnerabilities, such as session fixation, hijacking, and insecure cookie handling. It provides a structured security auditing workflow to analyze session ID generation, transmission security, and lifecycle management, ensuring robust authentication layers for web applications.
Use Cases
- Security Code Auditing: Automatically scan source code to identify weak session ID entropy, missing HttpOnly/Secure cookie flags, and predictable generation algorithms.
- Vulnerability Investigation: Use the skill to investigate potential session-related breaches by analyzing session validation checks and destruction logic during incident response.
- Compliance & QA Testing: Verify that web applications meet security standards by testing session timeouts, logout behaviors, and concurrent session handling during the development lifecycle.
- Authentication Hardening: Review and improve the security posture of authentication modules by identifying bypass steps and exploitable patterns in session transmission.
| name | analyzing-session-management |
|---|---|
| description | Detects session management vulnerabilities including session fixation, session hijacking, and insecure cookie handling. Use when analyzing authentication sessions, cookie security, or investigating session-related vulnerabilities. |
Session Management Detection
Detection Workflow
- Identify session operations: Find session creation code, locate session validation checks, identify session destruction, map session lifecycle
- Analyze session ID generation: Review session ID generation algorithm, check randomness and entropy, assess predictability, test for collision resistance
- Check transmission security: Verify SSL/TLS usage, check for session ID in URLs, assess cookie security flags, review transmission methods
- Assess session lifecycle: Verify session expiration, check logout behavior, assess session invalidation, review concurrent session handling
Key Patterns
- Session fixation: predictable session IDs, session IDs not regenerated after login, accepting attacker-provided session IDs, weak session ID generation
- Session hijacking: session IDs exposed in URLs, session IDs transmitted insecurely, missing SSL/TLS, weak session ID entropy
- Session timeout issues: missing session expiration, excessive session timeout, no session invalidation on logout, persistent sessions across devices
- Cookie security: missing HttpOnly flag, missing Secure flag, cookie accessible via JavaScript, cookie path/domain misconfiguration
Output Format
Report with: id, type, subtype, severity, confidence, location, vulnerability, session_generation (method, predictability, entropy), attack_scenario, bypass_steps, exploitable, impact, mitigation.
Severity Guidelines
- CRITICAL: Session fixation allowing account takeover
- HIGH: Session hijacking with weak session IDs
- MEDIUM: Excessive session timeout or missing logout
- LOW: Minor cookie security issues
See Also
patterns.md- Detailed detection patterns and exploitation scenariosexamples.md- Example analysis cases and code samplesreferences.md- CWE references and mitigation strategies