<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: testing-session-management-security
description: >-
  Test session management for fixation, hijacking, token entropy,
  cookie security attributes, concurrent session handling, and session
  invalidation on logout and privilege changes.
domain: cybersecurity
subdomain: application-security
tags:
  - session-management
  - session-fixation
  - cookie-security
  - owasp-a07
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1539", "T1550"]
  owasp-top10: ["A07"]
  tools: ["burp-suite", "curl", "python3", "mitmproxy"]
---

# Testing Session Management Security

## Overview

Session management flaws allow attackers to hijack user sessions, fixate
session IDs, or maintain access after logout. Testing validates token
randomness, cookie attributes, session lifecycle, and concurrent session policies.

## Prerequisites

- Tools: ["burp-suite", "curl", "python3", "mitmproxy"]
- Authorized testing engagement with written scope
- Target application access and credentials

## Workflow

### Step 1: Session Token Analysis

```bash
# Collect session tokens for entropy analysis
for i in $(seq 1 20); do
  TOKEN=$(curl -s -c - https://target.com/login | grep -oP 'session=\K[^;]+')
  echo "$TOKEN"
done > tokens.txt

# Analyze token entropy with Burp Sequencer or:
python3 -c "
import math, sys
tokens = open('tokens.txt').read().strip().split('\n')
charset = set(''.join(tokens))
entropy = len(tokens[0]) * math.log2(len(charset))
print(f'Token length: {len(tokens[0])}')
print(f'Charset size: {len(charset)}')
print(f'Estimated entropy: {entropy:.0f} bits')
print(f'Sufficient: {entropy >= 128}')
"
```

### Step 2: Session Fixation Testing

```bash
# Get pre-auth session ID
PRE_SESSION=$(curl -s -c - https://target.com/ | grep -oP 'session=\K[^\s]+')
echo "Pre-auth: $PRE_SESSION"

# Authenticate with same session
curl -s -b "session=$PRE_SESSION" -X POST https://target.com/login \
  -d "user=test&pass=test" -c - | grep session
# If session ID unchanged after login → FIXATION VULNERABILITY
```

### Step 3: Cookie Security Attributes

```bash
# Check cookie flags
curl -s -I https://target.com/login | grep -i "set-cookie"
# Verify: Secure, HttpOnly, SameSite, Path, Domain, Expires/Max-Age

# Test cookie over HTTP (missing Secure flag)
curl -s -I http://target.com/ | grep -i "set-cookie"
```

### Step 4: Session Invalidation Testing

```bash
# Test logout invalidation
TOKEN=$(curl -s -c - -X POST https://target.com/login \
  -d "user=test&pass=test" | grep -oP 'session=\K[^;]+')
curl -s -X POST https://target.com/logout -b "session=$TOKEN"
STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
  -b "session=$TOKEN" https://target.com/dashboard)
echo "Post-logout status: $STATUS"
# 200 = session not invalidated (vulnerability)

# Test session after password change
# Login → change password → use old session token
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Session fixation | App logs | Same session ID used before and after auth |
| Session hijacking | WAF | Session used from different IP/UA |
| Missing invalidation | Auth logs | API calls with logged-out session |

```yaml
title: Testing Session Management Security Detection
id: 9917bd0f-c9db-4774-90c4-fb59bd2dfc08
status: experimental
description: Detects suspicious activity related to testing session management security techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1539
  - attack.t1550
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] All relevant attack vectors tested
- [ ] Findings documented with severity and evidence
- [ ] Detection artifacts identified
- [ ] Remediation recommendations provided

## References

- [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)
- [MITRE ATT&CK](https://attack.mitre.org/)
