القائمة
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
استنادا إلى تصنيف SOC المهني
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-sess-11يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
عرض SKILL.md
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
| name | wstg-sess-11 |
| description | Testing for Concurrent Sessions |
| category | session-management |
| owasp_id | WSTG-SESS-11 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["session","cookies","csrf","token","wstg","sess"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-SESS-11
Testing for Concurrent Sessions
Concurrent session handling determines how an application manages multiple simultaneous sessions for the same user account. Improper handling can allow attackers to maintain access even after legitimate users change passwords or attempt to terminate sessions, and may enable account sharing in violation of terms of service.
#!/bin/bash
TARGET="https://target.com"
USERNAME="testuser"
PASSWORD="testpass"
# Create first session
session1=$(curl -s -c - -X POST "$TARGET/login" \
-d "username=$USERNAME&password=$PASSWORD" | grep -oP "SESSIONID=\K[^;]+")
echo "Session 1: $session1"
# Create second session (simulate different device)
session2=$(curl -s -c - -X POST "$TARGET/login" \
-d "username=$USERNAME&password=$PASSWORD" \
-H "User-Agent: DifferentDevice/1.0" | grep -oP "SESSIONID=\K[^;]+")
echo "Session 2: $session2"
-e
curl -s -b | grep -q && \
||
curl -s -b | grep -q && \
||
#!/bin/bash
TARGET="https://target.com"
# Create session
session=$(curl -s -c - -X POST "$TARGET/login" \
-d "username=test&password=oldpass" | grep -oP "SESSIONID=\K[^;]+")
# Change password (from another session or same)
curl -s -X POST "$TARGET/api/change-password" \
-b "SESSIONID=$session" \
-d "old_password=oldpass&new_password=newpass"
# Check if old session still works
response=$(curl -s -b "SESSIONID=$session" "$TARGET/dashboard")
if echo "$response" | grep -q "Welcome"; then
echo "[VULN] Session still valid after password change!"
else
echo "[OK] Session invalidated after password change"
fi
#!/usr/bin/env python3
import requests
import time
class ConcurrentSessionTester:
def __init__(self, base_url):
self.base_url = base_url
self.findings = []
def test_multiple_sessions(self, credentials):
"""Test if multiple sessions are allowed"""
print("[*] Testing multiple concurrent sessions...")
sessions = []
# Create multiple sessions
for i in range(3):
session = requests.Session()
session.headers['User-Agent'] = f'Device-{i}/1.0'
session.post(f"{self.base_url}/login", data=credentials)
sessions.append(session)
# Check if all sessions work
valid_count = 0
for i, session in enumerate(sessions):
response = session.get(f"{self.base_url}/dashboard")
if response.status_code == 200 and 'login' not in response.url.lower():
valid_count += 1
print(f" Session {i+1}: Valid")
else:
print(f" Session {i+1}: Invalid")
if valid_count == len(sessions):
print(f"[INFO] All {valid_count} concurrent sessions allowed")
elif valid_count == 1:
print("[OK] Only one session allowed at a time")
return valid_count
def test_password_change_invalidation(self, credentials, new_password):
"""Test session invalidation on password change"""
print("\n[*] Testing session invalidation on password change...")
# Create multiple sessions
session1 = requests.Session()
session2 = requests.Session()
session1.post(f"{self.base_url}/login", data=credentials)
session2.post(f"{self.base_url}/login", data=credentials)
# Change password from session1
session1.post(f"{self.base_url}/api/change-password", data={
"old_password": credentials['password'],
"new_password": new_password
})
# Check if session2 still works
response = session2.get(f"{self.base_url}/dashboard")
if response.status_code == 200 and 'login' not in response.url.lower():
print("[VULN] Other sessions not invalidated after password change!")
self.findings.append({
"issue": "Sessions persist after password change",
"severity": "High"
})
else:
print("[OK] Other sessions invalidated after password change")
def test_session_termination(self, credentials):
"""Test if user can terminate other sessions"""
print("\n[*] Testing session termination capability...")
# Check for session management endpoint
session = requests.Session()
session.post(f"{self.base_url}/login", data=credentials)
# Look for session management
response = session.get(f"{self.base_url}/settings/sessions")
if response.status_code == 200:
print("[OK] Session management available")
# Try to terminate sessions
session.post(f"{self.base_url}/settings/sessions/terminate-all")
else:
print("[INFO] No session management interface found")
def test_session_limit(self, credentials, max_sessions=10):
"""Test if there's a limit on concurrent sessions"""
print(f"\n[*] Testing session limit (trying {max_sessions} sessions)...")
sessions = []
for i in range(max_sessions):
session = requests.Session()
session.headers['User-Agent'] = f'Device-{i}/1.0'
response = session.post(f"{self.base_url}/login", data=credentials)
if response.status_code != 200 or 'login' in response.url.lower():
print(f"[INFO] Session limit reached at {i} sessions")
return i
sessions.append(session)
print(f"[WARN] No limit found - {max_sessions} concurrent sessions created")
return max_sessions
# Usage
tester = ConcurrentSessionTester("https://target.com")
credentials = {"username": "test", "password": "test"}
tester.test_multiple_sessions(credentials)
tester.test_password_change_invalidation(credentials, "newpassword123")
tester.test_session_termination(credentials)
tester.test_session_limit(credentials)
from flask import session, g
import time
class SessionManager:
MAX_CONCURRENT_SESSIONS = 5
def create_session(self, user_id):
"""Create new session with limits"""
# Get existing sessions
existing = Session.query.filter_by(user_id=user_id).all()
# Enforce limit
if len(existing) >= self.MAX_CONCURRENT_SESSIONS:
# Terminate oldest session
oldest = min(existing, key=lambda s: s.created_at)
Session.delete(oldest.id)
# Create new session
session_id = secrets.token_urlsafe(32)
Session.create(
id=session_id,
user_id=user_id,
created_at=time.time(),
device_info=request.headers.get('User-Agent')
)
return session_id
def invalidate_user_sessions(self, user_id, except_current=None):
"""Invalidate all sessions for user"""
sessions = Session.query.filter_by(user_id=user_id)
for s in sessions:
if s.id != except_current:
Session.delete(s.id)
# On password change
@app.route('/change-password', methods=['POST'])
@require_auth
def change_password():
if update_password(g.user, request.form):
# Invalidate all other sessions
session_manager.invalidate_user_sessions(
g.user.id,
except_current=session.get('id')
)
return jsonify({"success": True})
| Finding | CVSS | Severity |
|---|---|---|
| Sessions persist after password change | 7.5 | High |
| No concurrent session limit | 4.3 | Medium |
| No session termination capability | 4.3 | Medium |
| CWE ID | Title |
|---|---|
| CWE-613 | Insufficient Session Expiration |
| CWE-384 | Session Fixation |
[ ] Concurrent sessions tested
[ ] Password change invalidation tested
[ ] Session termination tested
[ ] Session limit tested
[ ] Session management UI checked
[ ] Findings documented