wstg-sess-08

name	wstg-sess-08
description	Testing for Session Puzzling
category	session-management
owasp_id	WSTG-SESS-08
version	1.0.0
author	cyberstrike-official
tags	["session","cookies","csrf","token","wstg","sess"]
tech_stack	[]
cwe_ids	["CWE-200"]
chains_with	[]
prerequisites	[]
severity_boost	{}

wstg-sess-08

Test ID

WSTG-SESS-08

Test Name

Testing for Session Puzzling (Session Variable Overloading)

High-Level Description

Session puzzling occurs when session variables are used for multiple purposes across different application flows. Attackers can manipulate session state in one flow to affect behavior in another, potentially bypassing authentication or authorization controls.

---

What to Check

• Session variable reuse across flows
• Authentication bypass via flow manipulation
• State confusion attacks
• Password reset session abuse
• Registration flow exploitation

---

How to Test

Step 1: Identify Session Variables

# Track session variables across different flows
# 1. Login flow
# 2. Registration flow
# 3. Password reset flow
# 4. Account verification flow

# Look for common session variables:
# - user_id, email, username
# - authenticated, verified
# - role, permissions
# - step, stage, phase

Step 2: Test Flow Manipulation

#!/usr/bin/env python3
import requests

class SessionPuzzlingTester:
    def __init__(self, base_url):
        self.base_url = base_url
        self.findings = []

    def test_password_reset_bypass(self):
        """Test if password reset flow can bypass login"""
        print()

        session = requests.Session()

        
        session.post(,
                    data={: })

        
        response = session.get()

         response.status_code ==      response.url.lower():
            ()
            .findings.append({
                : ,
                : 
            })

     ():
        
        ()

        session = requests.Session()

        
        session.post(,
                    data={: , : })

        
        response = session.get()

         response.status_code == :
            ()

     ():
        
        ()

        session = requests.Session()

        
        response = session.post(,
                               data={: })

         response.status_code == :
            ()


tester = SessionPuzzlingTester()
tester.test_password_reset_bypass()
tester.test_registration_bypass()
tester.test_step_manipulation()