用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-sess-01命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | wstg-sess-01 |
| description | Testing for Session Management Schema |
| category | session-management |
| owasp_id | WSTG-SESS-01 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["session","cookies","csrf","token","wstg","sess"] |
| tech_stack | ["cookies","jwt","session"] |
| cwe_ids | ["CWE-539"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-SESS-01
Testing for Session Management Schema
Session management is the mechanism by which a web application maintains state with users across multiple requests. Weaknesses in session management can lead to session hijacking, fixation, or prediction attacks. This test evaluates the overall session management implementation including token generation, transmission, storage, and lifecycle management.
| Phase | Security Concern |
|---|---|
| Generation | Randomness, entropy |
| Transmission | HTTPS, secure headers |
| Storage | HttpOnly, Secure flags |
| Validation | Server-side checks |
| Termination | Proper invalidation |
# Capture session tokens from response headers
curl -sI "https://target.com/login" | grep -iE "set-cookie|session|token"
# Common session token names:
# JSESSIONID (Java)
# PHPSESSID (PHP)
# ASP.NET_SessionId (.NET)
# session_id
# SESSIONID
# auth_token
# access_token
# Check multiple requests for all cookies
for i in {1..5};
curl -s -c - | grep -v
#!/usr/bin/env python3
import requests
import math
from collections import Counter
class SessionEntropyAnalyzer:
def __init__(self, url, session_cookie_name):
self.url = url
self.cookie_name = session_cookie_name
self.tokens = []
def collect_tokens(self, count=20):
"""Collect multiple session tokens"""
print(f"[*] Collecting {count} session tokens...")
for i in range(count):
try:
session = requests.Session()
response = session.get(self.url)
for cookie in session.cookies:
if cookie.name == self.cookie_name:
self.tokens.append(cookie.value)
break
except Exception as e:
print(f"[ERROR] {e}")
print(f"[*] Collected {len(self.tokens)} tokens")
return self.tokens
def calculate_entropy(self, token):
"""Calculate Shannon entropy of token"""
if not token:
return 0
freq = Counter(token)
length = len(token)
entropy = 0
for count in freq.values():
p = count / length
entropy -= p * math.log2(p)
return entropy * length # Total entropy bits
def analyze_randomness(self):
"""Analyze token randomness"""
print("\n[*] Analyzing token randomness...")
if not self.tokens:
print("[!] No tokens collected")
return
# Token length analysis
lengths = [len(t) for t in self.tokens]
print(f"Token lengths: min={min(lengths)}, max={max(lengths)}, avg={sum(lengths)/len(lengths):.1f}")
# Entropy analysis
entropies = [self.calculate_entropy(t) for t in self.tokens]
avg_entropy = sum(entropies) / len(entropies)
print(f"Average entropy: {avg_entropy:.1f} bits")
if avg_entropy < 64:
print("[VULN] Low entropy - tokens may be predictable")
elif avg_entropy < 128:
print("[WARN] Moderate entropy - consider increasing")
else:
print("[OK] Good entropy (>= 128 bits)")
# Check for common prefixes
if len(self.tokens) > 1:
common_prefix = self.find_common_prefix()
if len(common_prefix) > 5:
print(f"[WARN] Common prefix found: {common_prefix}")
# Check character set
all_chars = set(''.join(self.tokens))
print(f"Character set size: {len(all_chars)}")
def find_common_prefix(self):
"""Find common prefix in tokens"""
if not self.tokens:
return ""
prefix = ""
for chars in zip(*self.tokens):
if len(set(chars)) == 1:
prefix += chars[0]
else:
break
return prefix
def check_sequentiality(self):
"""Check if tokens appear sequential"""
print("\n[*] Checking for sequential patterns...")
# Extract numeric portions
import re
numeric_parts = []
for token in self.tokens:
numbers = re.findall(r'\d+', token)
if numbers:
numeric_parts.append(int(numbers[-1]))
if len(numeric_parts) >= 2:
# Check if sequential
diffs = [numeric_parts[i+1] - numeric_parts[i]
for i in range(len(numeric_parts)-1)]
if len(set(diffs)) == 1 and diffs[0] > 0:
print(f"[VULN] Sequential pattern detected: increment = {diffs[0]}")
else:
print("[OK] No obvious sequential pattern")
# Usage
analyzer = SessionEntropyAnalyzer(
"https://target.com/",
"SESSIONID"
)
analyzer.collect_tokens(20)
analyzer.analyze_randomness()
analyzer.check_sequentiality()
#!/bin/bash
# Test session token transmission security
TARGET="https://target.com"
# Get session token
response=$(curl -s -c - "$TARGET/login" -d "user=test&pass=test")
# Check for Secure flag
if echo "$response" | grep -i "Secure"; then
echo "[OK] Secure flag present"
else
echo "[VULN] Missing Secure flag - token sent over HTTP"
fi
# Check for HttpOnly flag
if echo "$response" | grep -i "HttpOnly"; then
echo "[OK] HttpOnly flag present"
else
echo "[VULN] Missing HttpOnly flag - XSS can steal token"
fi
# Check for SameSite attribute
if echo "$response" | grep -i "SameSite"; then
samesite=$(echo "$response" | grep -oP "SameSite=\w+")
echo "[OK] SameSite attribute: $samesite"
else
echo "[WARN] Missing SameSite attribute"
fi
# Check if token appears in URL
curl -s -I "$TARGET/authenticated-page" | grep -i "location.*session"
if [ $? -eq 0 ]; then
echo "[VULN] Session token in URL"
fi
#!/bin/bash
# Test how application handles session tokens
TARGET="https://target.com"
VALID_SESSION="valid_session_token"
# Test with no session
echo "=== No session token ==="
curl -s -I "$TARGET/protected"
# Test with invalid session
echo "=== Invalid session token ==="
curl -s -I "$TARGET/protected" -b "SESSIONID=invalid123"
# Test with expired session
echo "=== Expired session token ==="
curl -s -I "$TARGET/protected" -b "SESSIONID=expired_token"
# Test with empty session
echo "=== Empty session token ==="
curl -s -I "$TARGET/protected" -b "SESSIONID="
# Test with null session
echo "=== Null session token ==="
curl -s -I "$TARGET/protected" -b "SESSIONID=null"
#!/bin/bash
# Test if session ID changes after authentication
TARGET="https://target.com"
# Get pre-auth session
pre_auth=$(curl -s -c - "$TARGET/" | grep -oP "SESSIONID=\K[^;]+")
echo "Pre-auth session: $pre_auth"
# Authenticate
post_auth=$(curl -s -c - -b "SESSIONID=$pre_auth" \
"$TARGET/login" -d "user=test&pass=test" | grep -oP "SESSIONID=\K[^;]+")
echo "Post-auth session: $post_auth"
if [ "$pre_auth" == "$post_auth" ]; then
echo "[VULN] Session fixation - ID not renewed after login"
else
echo "[OK] Session ID renewed after login"
fi
# Test privilege change session renewal
# After privilege escalation, session should also renew
// Browser console tests for session storage
// Check for session data in localStorage (not recommended)
console.log("localStorage session data:")
for (let key in localStorage) {
if (
key.toLowerCase().includes("session") ||
key.toLowerCase().includes("token") ||
key.toLowerCase().includes("auth")
) {
console.log(key + ": " + localStorage[key])
}
}
// Check sessionStorage
console.log("\nsessionStorage session data:")
for (let key in sessionStorage) {
if (key.toLowerCase().includes("session") || key.toLowerCase().includes("token")) {
console.log(key + ": " + sessionStorage[key])
}
}
// If session data in storage is accessible, it's vulnerable to XSS
#!/usr/bin/env python3
import requests
import time
from urllib.parse import urlparse
class SessionAnalyzer:
def __init__(self, base_url):
self.base_url = base_url
self.session = requests.Session()
self.findings = []
def analyze_cookie_attributes(self):
"""Analyze session cookie security attributes"""
print("\n[*] Analyzing cookie attributes...")
response = self.session.get(self.base_url)
for cookie in self.session.cookies:
print(f"\nCookie: {cookie.name}")
print(f" Value length: {len(cookie.value)}")
print(f" Domain: {cookie.domain}")
print(f" Path: {cookie.path}")
print(f" Secure: {cookie.secure}")
print(f" HttpOnly: {cookie.has_nonstandard_attr('HttpOnly')}")
# Check for issues
if not cookie.secure:
self.findings.append({
"issue": "Missing Secure flag",
"cookie": cookie.name,
"severity": "High"
})
if 'httponly' not in str(cookie).lower():
self.findings.append({
"issue": "Missing HttpOnly flag",
"cookie": cookie.name,
"severity": "High"
})
if len(cookie.value) < 16:
self.findings.append({
"issue": "Short token length",
"cookie": cookie.name,
"severity": "Medium"
})
def test_session_in_url(self):
"""Check if session appears in URLs"""
print("\n[*] Testing for session in URL...")
# Login and follow redirects
response = self.session.get(
f"{self.base_url}/login",
allow_redirects=True
)
# Check URL history for session tokens
for resp in response.history:
if 'session' in resp.url.lower() or 'token' in resp.url.lower():
self.findings.append({
"issue": "Session token in URL",
"url": resp.url,
"severity": "High"
})
print(f"[VULN] Session in URL: {resp.url}")
def test_session_validity(self):
"""Test session validation"""
print("\n[*] Testing session validation...")
# Test with manipulated session
manipulated_values = [
"",
"null",
"undefined",
"0",
"admin",
"../../../etc/passwd",
"<script>alert(1)</script>",
"A" * 1000,
]
for value in manipulated_values:
test_session = requests.Session()
test_session.cookies.set('SESSIONID', value)
try:
response = test_session.get(f"{self.base_url}/protected")
if response.status_code == 200:
print(f"[VULN] Accepted manipulated session: {value[:50]}")
self.findings.append({
"issue": "Weak session validation",
"value": value[:50],
"severity": "High"
})
except:
pass
def generate_report(self):
"""Generate session analysis report"""
print("\n" + "="*60)
print("SESSION MANAGEMENT ANALYSIS REPORT")
print("="*60)
if not self.findings:
print("\nNo issues found.")
return
print(f"\nTotal findings: {len(self.findings)}")
# Group by severity
by_severity = {}
for finding in self.findings:
sev = finding['severity']
if sev not in by_severity:
by_severity[sev] = []
by_severity[sev].append(finding)
for severity in ['Critical', 'High', 'Medium', 'Low']:
if severity in by_severity:
print(f"\n{severity} ({len(by_severity[severity])}):")
for f in by_severity[severity]:
print(f" - {f['issue']}")
# Usage
analyzer = SessionAnalyzer("https://target.com")
analyzer.analyze_cookie_attributes()
analyzer.test_session_in_url()
analyzer.test_session_validity()
analyzer.generate_report()
| Tool | Description | Usage |
|---|---|---|
| Burp Suite | Session analysis | Sequencer, token analysis |
| OWASP ZAP | Session testing | Automated scanning |
| Cookie-Editor | Browser extension | Cookie manipulation |
| Tool | Description |
|---|---|
| Burp Sequencer | Token randomness analysis |
| Custom scripts | Entropy calculation |
import secrets
import hashlib
import time
class SecureSessionManager:
SESSION_LENGTH = 32 # 256 bits
@staticmethod
def generate_session_id():
"""Generate cryptographically secure session ID"""
return secrets.token_urlsafe(SecureSessionManager.SESSION_LENGTH)
@staticmethod
def create_session(user_id, ip_address, user_agent):
"""Create new session with metadata"""
session_id = SecureSessionManager.generate_session_id()
session_data = {
'session_id': session_id,
'user_id': user_id,
'created_at': time.time(),
'last_activity': time.time(),
'ip_address': hashlib.sha256(ip_address.encode()).hexdigest(),
'user_agent_hash': hashlib.sha256(user_agent.encode()).hexdigest(),
}
# Store in session store
SessionStore.save(session_id, session_data)
return session_id
from flask import Flask, make_response
app = Flask(__name__)
# Session configuration
app.config.update(
SESSION_COOKIE_SECURE=True, # HTTPS only
SESSION_COOKIE_HTTPONLY=True, # No JavaScript access
SESSION_COOKIE_SAMESITE='Strict', # CSRF protection
PERMANENT_SESSION_LIFETIME=3600, # 1 hour timeout
)
# Or set manually
@app.after_request
def set_secure_cookie(response):
response.set_cookie(
'session_id',
value=session_id,
secure=True,
httponly=True,
samesite='Strict',
max_age=3600,
path='/'
)
return response
import hashlib
import time
class SessionValidator:
MAX_INACTIVITY = 1800 # 30 minutes
MAX_LIFETIME = 86400 # 24 hours
def validate_session(self, session_id, request):
"""Validate session with multiple checks"""
session = SessionStore.get(session_id)
if not session:
return False, "Session not found"
# Check session age
if time.time() - session['created_at'] > self.MAX_LIFETIME:
SessionStore.delete(session_id)
return False, "Session expired"
# Check inactivity
if time.time() - session['last_activity'] > self.MAX_INACTIVITY:
SessionStore.delete(session_id)
return False, "Session inactive"
# Validate IP (optional - may cause issues with mobile)
ip_hash = hashlib.sha256(request.remote_addr.encode()).hexdigest()
if session['ip_address'] != ip_hash:
# Log potential session hijacking
log_security_event("IP mismatch", session_id)
# Optionally invalidate session
# Update last activity
session['last_activity'] = time.time()
SessionStore.save(session_id, session)
return True, None
| Finding | CVSS | Severity |
|---|---|---|
| Predictable session tokens | 9.1 | Critical |
| Missing Secure flag | 7.5 | High |
| Missing HttpOnly flag | 6.1 | Medium |
| Session in URL | 7.5 | High |
| Short session token | 5.3 | Medium |
| CWE ID | Title | Description |
|---|---|---|
| CWE-330 | Insufficient Randomness | Weak token generation |
| CWE-614 | HTTPS Session Cookie Without Secure | Missing Secure flag |
| CWE-1004 | Sensitive Cookie Without HttpOnly | Missing HttpOnly |
| CWE-598 | Session ID in URL | Exposure via Referer |
[ ] Session tokens identified
[ ] Token entropy analyzed
[ ] Token randomness tested
[ ] Cookie flags checked (Secure, HttpOnly, SameSite)
[ ] Session in URL checked
[ ] Session renewal on auth tested
[ ] Session validation tested
[ ] Session storage analyzed
[ ] Token length verified
[ ] Findings documented
[ ] Remediation recommendations provided