用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-sess-07命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | wstg-sess-07 |
| description | Testing for Session Timeout |
| category | session-management |
| owasp_id | WSTG-SESS-07 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["session","cookies","csrf","token","wstg","sess"] |
| tech_stack | [] |
| cwe_ids | ["CWE-384"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-SESS-07
Testing for Session Timeout
Session timeout controls how long a session remains valid after periods of inactivity or absolute time limits. Improper timeout configuration can leave sessions vulnerable to hijacking if users don't explicitly logout, especially on shared computers or public networks.
#!/bin/bash
TARGET="https://target.com"
# Get session
session=$(curl -s -c - -X POST "$TARGET/login" \
-d "username=test&password=test" | grep -oP "SESSIONID=\K[^;]+")
echo "Session: $session"
# Wait for timeout (adjust based on expected timeout)
echo "Waiting for idle timeout..."
for i in {1..60}; do
sleep 60 # Wait 1 minute
response=$(curl -s -b "SESSIONID=$session" "$TARGET/dashboard")
if echo "$response" | grep -qi "login\|expired\|timeout"; then
0
#!/usr/bin/env python3
import requests
import time
def test_absolute_timeout(base_url, credentials, max_hours=24):
"""Test absolute session timeout"""
session = requests.Session()
session.post(f"{base_url}/login", data=credentials)
start_time = time.time()
while True:
# Keep session active
time.sleep(300) # 5 minutes
response = session.get(f"{base_url}/dashboard")
elapsed_hours = (time.time() - start_time) / 3600
if 'login' in response.url.lower():
print(f"Session expired after {elapsed_hours:.2f} hours (absolute)")
return elapsed_hours
if elapsed_hours >= max_hours:
print(f"[VULN] Session still valid after {max_hours} hours")
return None
print(f"Hour {elapsed_hours:.2f}: Session still active")
# Usage
test_absolute_timeout("https://target.com", {"username": "test", "password": "test"})
#!/usr/bin/env python3
import requests
import time
class SessionTimeoutTester:
def __init__(self, base_url):
self.base_url = base_url
self.findings = []
def test_idle_timeout(self, login_creds, protected_page, expected_timeout_mins):
"""Test idle timeout"""
print(f"[*] Testing idle timeout (expected: {expected_timeout_mins} mins)...")
session = requests.Session()
session.post(f"{self.base_url}/login", data=login_creds)
# Verify authenticated
if session.get(f"{self.base_url}{protected_page}").status_code != 200:
print("[!] Authentication failed")
return
# Wait and check
intervals = [5, 10, 15, 30, 60, 120] # minutes
for mins in intervals:
if mins > expected_timeout_mins * 2:
break
print(f" Waiting {mins} minutes...")
time.sleep(mins * 60)
response = session.get(f"{self.base_url}{protected_page}")
if 'login' in response.url.lower() or response.status_code == 401:
print(f" [OK] Session expired after ~{mins} minutes")
if mins > expected_timeout_mins:
self.findings.append({
"issue": f"Timeout longer than expected ({mins} vs {expected_timeout_mins} mins)",
"severity": "Low"
})
return
print(f" [VULN] Session still valid after extended period")
self.findings.append({
"issue": "No effective idle timeout",
"severity": "High"
})
def test_timeout_bypass(self, login_creds, protected_page):
"""Test if minimal activity prevents timeout"""
print("[*] Testing timeout bypass with minimal activity...")
# Test if simple GET requests reset timeout indefinitely
# This should be acceptable for idle timeout but not absolute
# Usage
tester = SessionTimeoutTester("https://target.com")
tester.test_idle_timeout(
{"username": "test", "password": "test"},
"/dashboard",
expected_timeout_mins=30
)
import time
from flask import session, redirect, request
# Configuration
IDLE_TIMEOUT = 1800 # 30 minutes
ABSOLUTE_TIMEOUT = 28800 # 8 hours
@app.before_request
def check_session_timeout():
if 'user_id' not in session:
return
now = time.time()
# Check absolute timeout
if now - session.get('created_at', now) > ABSOLUTE_TIMEOUT:
session.clear()
return redirect('/login?reason=absolute_timeout')
# Check idle timeout
if now - session.get('last_activity', now) > IDLE_TIMEOUT:
session.clear()
return redirect('/login?reason=idle_timeout')
# Update last activity
session['last_activity'] = now
@app.route('/login', methods=['POST'])
def login():
if authenticate(request.form):
session['user_id'] = user.id
session['created_at'] = time.time()
session['last_activity'] = time.time()
return redirect('/dashboard')
| Finding | CVSS | Severity |
|---|---|---|
| No idle timeout | 5.3 | Medium |
| Excessive timeout (>4 hours) | 4.3 | Medium |
| No absolute timeout | 5.3 | Medium |
| CWE ID | Title |
|---|---|
| CWE-613 | Insufficient Session Expiration |
[ ] Idle timeout tested
[ ] Absolute timeout tested
[ ] Timeout values documented
[ ] Activity bypass tested
[ ] Findings documented
[ ] Remediation provided