analyzing-session-management
Detects session management vulnerabilities including session fixation, session hijacking, and insecure cookie handling. Use when analyzing authentication sessions, cookie security, or investigating session-related vulnerabilities.
When & Why to Use This Skill
This Claude skill provides a comprehensive framework for detecting and mitigating session management vulnerabilities such as session fixation, hijacking, and insecure cookie handling. It automates the analysis of authentication lifecycles, evaluates session ID entropy, and verifies transmission security to harden web applications against unauthorized access and account takeover.
Use Cases
- Automated Security Audits: Identifying predictable session IDs and weak generation algorithms within web application source code or configurations.
- Cookie Security Compliance: Verifying that session cookies implement essential security flags like 'HttpOnly', 'Secure', and 'SameSite' to prevent cross-site scripting (XSS) and hijacking.
- Session Lifecycle Investigation: Analyzing session timeout behaviors and logout mechanisms to ensure sessions are properly invalidated and cannot be reused by attackers.
- Vulnerability Assessment: Generating detailed security reports that categorize session-related risks by severity, providing actionable mitigation steps for developers and SRE teams.
| name | analyzing-session-management |
|---|---|
| description | Detects session management vulnerabilities including session fixation, session hijacking, and insecure cookie handling. Use when analyzing authentication sessions, cookie security, or investigating session-related vulnerabilities. |
Session Management Detection
Detection Workflow
- Identify session operations: Find session creation code, locate session validation checks, identify session destruction, map session lifecycle
- Analyze session ID generation: Review session ID generation algorithm, check randomness and entropy, assess predictability, test for collision resistance
- Check transmission security: Verify SSL/TLS usage, check for session ID in URLs, assess cookie security flags, review transmission methods
- Assess session lifecycle: Verify session expiration, check logout behavior, assess session invalidation, review concurrent session handling
Key Patterns
- Session fixation: predictable session IDs, session IDs not regenerated after login, accepting attacker-provided session IDs, weak session ID generation
- Session hijacking: session IDs exposed in URLs, session IDs transmitted insecurely, missing SSL/TLS, weak session ID entropy
- Session timeout issues: missing session expiration, excessive session timeout, no session invalidation on logout, persistent sessions across devices
- Cookie security: missing HttpOnly flag, missing Secure flag, cookie accessible via JavaScript, cookie path/domain misconfiguration
Output Format
Report with: id, type, subtype, severity, confidence, location, vulnerability, session_generation (method, predictability, entropy), attack_scenario, bypass_steps, exploitable, impact, mitigation.
Severity Guidelines
- CRITICAL: Session fixation allowing account takeover
- HIGH: Session hijacking with weak session IDs
- MEDIUM: Excessive session timeout or missing logout
- LOW: Minor cookie security issues
See Also
patterns.md- Detailed detection patterns and exploitation scenariosexamples.md- Example analysis cases and code samplesreferences.md- CWE references and mitigation strategies