hunt-session

Name: hunt-session
Author: elementalsouls

3.0kstars461forks

How to install hunt-session?

elementalsouls/claude-bughunter/hunt-session

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-session

Installs into the current project.

Summary

Hunt Session Management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on logout / password-change / email-change, predictable or low-entropy session IDs, JWT-as-session with no exp/revocation, refresh-token rotation/reuse-detection gaps,

Files · 1

View on GitHub

SKILL.md

1	## Autonomous Testing Priority
2
3	Missing HttpOnly on cookies is auto-detected — focus your active testing on lifecycle invalidation (higher impact).
4
5	Pattern 1 — Session survives logout (most common high-value finding):
6	1. Login and note the session token/cookie value
7	2. Call the logout endpoint (`/logout`, `POST /api/logout`, etc.)
8	3. Try to use the OLD session token to access a protected resource (`/api/me`, `/dashboard`, `/account`)
9	4. If 200 with user data → session not invalidated on logout = ATO persistence
10
11	Pattern 2 — Session not regenerated on login (session fixation):
12	1. GET any page to receive a pre-authentication session token/cookie
13	2. POST valid credentials to the login endpoint
14	3. Compare the session token BEFORE and AFTER login
15	4. If the token is unchanged → session fixation vulnerability
16
17	Pattern 3 — Session survives password change:
18	1. Login → record session A value
19	2. Change the password via the account settings endpoint
20	3. Replay session A on a protected endpoint
21	4. If 200 → token not rotated on credential change = persistent ATO (critical chain when combined with XSS/cookie theft)
22
23	Content-type: Login and session endpoints vary — use `application/json` for REST APIs, `application/x-www-form-urlencoded` for traditional web forms. Try both if the first returns an unexpected response.
24
25	Proof: A protected-resource 200 response (with user data) using a session token that should have been invalidated confirms the finding.
26
27	---
28
29	# HUNT-SESSION — Session Management
30
31	## Crown Jewel Targets
32
33	Session fixation leading to admin hijack = Critical. Session surviving a password change = High-to-Critical (persistent ATO from a stolen cookie that the victim believes they revoked by resetting their password).
34
35	Highest-value chains:
36	- Session fixation — server accepts a session ID set by the client and does NOT regenerate it on login → attacker pre-plants an ID, victim authenticates, attacker rides the now-authenticated session → persistent ATO.
37	- No invalidation on logout — old token still works after `/logout` → theft window never closes.
38	- No invalidation on password / email change — a stolen session survives the victim's "I think I was hacked, let me reset" → persistent ATO. This is the single highest-paid session bug class.
39	- Refresh-token reuse without rotation-detection — a leaked refresh token mints fresh access tokens forever; no reuse-detection means the legitimate user's later refresh does NOT revoke the attacker's branch.
40	- Predictable / low-entropy session ID — sequential, timestamp- or userId-derived IDs → brute-force or compute other users' sessions.
41	- JWT-as-session with no `exp` / no revocation list — stolen JWT = permanent access; logout is cosmetic.
42
43	---
44
45	## Grounding — patterns that shaped each phase
46
47	No invented CVE/report IDs below. These are the named, publicly-documented patterns this skill encodes:
48
49	- Session fixation, login-CSRF, no-regeneration-on-auth — OWASP WSTG-SESS-03 / WSTG-SESS-01; the classic ACROS / Mitja Kolšek session-fixation paper. Highest-impact variant: fixing the session of an SSO/admin user.
50	- SameSite=Lax sibling-subdomain CSRF reaching session state — Argo CD CVE-2024-22424 (Lax cookies sent on top-level cross-site navigations from a sibling subdomain). Use this when a session cookie relies on `SameSite=Lax` as its only CSRF defence.
51	- Refresh-token rotation & automatic reuse-detection — the Auth0/IETF OAuth-Security-BCP model: a rotated refresh token, if replayed, must invalidate the entire token family. Absence = the core bug to prove.
52	- Device Bound Session Credentials (DBSC) — the W3C/Chrome DBSC draft binds a session to a TPM/device key. Test the downgrade: does the server still accept a non-bound cookie when the DBSC challenge is stripped?
53	- Cookie attribute hardening — OWASP WSTG-SESS-02; `__Host-`/`__Secure-` prefixes per RFC 6265bis. Missing `HttpOnly` is only a finding when a real XSS/DOM sink exists (chain with `hunt-xss`/`hunt-dom`).
54	- Entropy — NIST SP 800-63B requires ≥64 bits of entropy in a session identifier. Treat anything decodable to a counter/timestamp/userId as a finding regardless of length.
55
56	Cross-refs: ATO chaining → `hunt-ato`; JWT alg/kid ta

People who liked this also viewed

6 picks

Type

hunt-session

3.0kstars461forks

View on GitHub

How to install hunt-session?

elementalsouls/claude-bughunter/hunt-session

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-session

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	## Autonomous Testing Priority
2
3	Missing HttpOnly on cookies is auto-detected — focus your active testing on lifecycle invalidation (higher impact).
4
5	Pattern 1 — Session survives logout (most common high-value finding):
6	1. Login and note the session token/cookie value
7	2. Call the logout endpoint (`/logout`, `POST /api/logout`, etc.)
8	3. Try to use the OLD session token to access a protected resource (`/api/me`, `/dashboard`, `/account`)
9	4. If 200 with user data → session not invalidated on logout = ATO persistence
10
11	Pattern 2 — Session not regenerated on login (session fixation):
12	1. GET any page to receive a pre-authentication session token/cookie
13	2. POST valid credentials to the login endpoint
14	3. Compare the session token BEFORE and AFTER login
15	4. If the token is unchanged → session fixation vulnerability
16
17	Pattern 3 — Session survives password change:
18	1. Login → record session A value
19	2. Change the password via the account settings endpoint
20	3. Replay session A on a protected endpoint
21	4. If 200 → token not rotated on credential change = persistent ATO (critical chain when combined with XSS/cookie theft)
22
23	Content-type: Login and session endpoints vary — use `application/json` for REST APIs, `application/x-www-form-urlencoded` for traditional web forms. Try both if the first returns an unexpected response.
24
25	Proof: A protected-resource 200 response (with user data) using a session token that should have been invalidated confirms the finding.
26
27	---
28
29	# HUNT-SESSION — Session Management
30
31	## Crown Jewel Targets
32
33	Session fixation leading to admin hijack = Critical. Session surviving a password change = High-to-Critical (persistent ATO from a stolen cookie that the victim believes they revoked by resetting their password).
34
35	Highest-value chains:
36	- Session fixation — server accepts a session ID set by the client and does NOT regenerate it on login → attacker pre-plants an ID, victim authenticates, attacker rides the now-authenticated session → persistent ATO.
37	- No invalidation on logout — old token still works after `/logout` → theft window never closes.
38	- No invalidation on password / email change — a stolen session survives the victim's "I think I was hacked, let me reset" → persistent ATO. This is the single highest-paid session bug class.
39	- Refresh-token reuse without rotation-detection — a leaked refresh token mints fresh access tokens forever; no reuse-detection means the legitimate user's later refresh does NOT revoke the attacker's branch.
40	- Predictable / low-entropy session ID — sequential, timestamp- or userId-derived IDs → brute-force or compute other users' sessions.
41	- JWT-as-session with no `exp` / no revocation list — stolen JWT = permanent access; logout is cosmetic.
42
43	---
44
45	## Grounding — patterns that shaped each phase
46
47	No invented CVE/report IDs below. These are the named, publicly-documented patterns this skill encodes:
48
49	- Session fixation, login-CSRF, no-regeneration-on-auth — OWASP WSTG-SESS-03 / WSTG-SESS-01; the classic ACROS / Mitja Kolšek session-fixation paper. Highest-impact variant: fixing the session of an SSO/admin user.
50	- SameSite=Lax sibling-subdomain CSRF reaching session state — Argo CD CVE-2024-22424 (Lax cookies sent on top-level cross-site navigations from a sibling subdomain). Use this when a session cookie relies on `SameSite=Lax` as its only CSRF defence.
51	- Refresh-token rotation & automatic reuse-detection — the Auth0/IETF OAuth-Security-BCP model: a rotated refresh token, if replayed, must invalidate the entire token family. Absence = the core bug to prove.
52	- Device Bound Session Credentials (DBSC) — the W3C/Chrome DBSC draft binds a session to a TPM/device key. Test the downgrade: does the server still accept a non-bound cookie when the DBSC challenge is stripped?
53	- Cookie attribute hardening — OWASP WSTG-SESS-02; `__Host-`/`__Secure-` prefixes per RFC 6265bis. Missing `HttpOnly` is only a finding when a real XSS/DOM sink exists (chain with `hunt-xss`/`hunt-dom`).
54	- Entropy — NIST SP 800-63B requires ≥64 bits of entropy in a session identifier. Treat anything decodable to a counter/timestamp/userId as a finding regardless of length.
55
56	Cross-refs: ATO chaining → `hunt-ato`; JWT alg/kid ta

People who liked this also viewed

6 picks

Type