hunt-session

Autonomous Testing Priority

Missing HttpOnly on cookies is auto-detected — focus your active testing on lifecycle invalidation (higher impact).

Pattern 1 — Session survives logout (most common high-value finding):

1. Login and note the session token/cookie value
2. Call the logout endpoint (/logout, POST /api/logout, etc.)
3. Try to use the OLD session token to access a protected resource (/api/me, /dashboard, /account)
4. If 200 with user data → session not invalidated on logout = ATO persistence

Pattern 2 — Session not regenerated on login (session fixation):

1. GET any page to receive a pre-authentication session token/cookie
2. POST valid credentials to the login endpoint
3. Compare the session token BEFORE and AFTER login
4. If the token is unchanged → session fixation vulnerability