Authenticated session handling

When it applies

The interesting bugs live after login — cross-tenant IDOR/BOLA, mass assignment, injection on the real data APIs — but the run keeps collapsing to pre-auth findings because login is gated by MFA/OTP, or the token expires and every automated request 401s halfway through. This skill is the setup step that makes authenticated testing actually work. It does not attack the auth mechanism (web-oauth, web-auth-jwt, api-auth-attacks do that) — it obtains one legitimate session and keeps it usable.

Why it works

Post-auth coverage silently disappears when tooling can't hold a session: the scanner logs out, the token lapses, or MFA can't be satisfied autonomously. Capturing the session as a reusable artifact — the cookie/localStorage state for browser-driven testing and the raw bearer token for direct API replay — decouples "log in once" from "test a thousand requests," so the whole authenticated surface stays reachable for the life of the token.