<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Testing Session Management Security

## curl — Session Testing
```bash
# Collect session tokens
curl -s -c - URL/login | grep session

# Check cookie attributes
curl -s -I URL | grep -i set-cookie

# Test session after logout
curl -s -X POST URL/logout -b "session=TOKEN"
curl -s -b "session=TOKEN" URL/dashboard
```

## Burp Suite — Sequencer
Use Burp Sequencer to capture and analyze token entropy with statistical tests
(FIPS 140-2, bit-level analysis, character-level analysis).

## mitmproxy — Session Interception
```bash
mitmproxy -s session_capture.py --mode transparent
```
