2

How would I test that a website I'm successfully authenticated on (currently in session) has set my session ID in a safe way and isn't vulnerable?

I believe a session ID should be obscured at the very least (rather than referencing an auto-incremented id, for example), so I'd like to check this. Other than that, I'd like to look at how the session ID is set (I think - is this of relevance?). And also, how can interrogate the session ID? I've fired up dev tools and had a look in the cookie request header, but it doesn't appear to be in there.

3

This can include many test cases. Go through OWASP link on this. However, I want to discuss a few cases.
1) Session Fixation: Ensure that the session ID is set to a new value after successful authentication takes place.

2) Session ID length: Must be of at least 16 bytes. (This is from OWASP page)

3) Session ID Entropy: Must be unpredictable (random enough) to prevent guessing attacks. You can use Burpsuite or other tools to check randomness.

4) Secure and HTTP Only Attribute: These need to be set for the session IDs.

5) Check whether session IDs are cleared from both the browser and the server side( and not only browser) after logout.

6) Ensure the response from the server in which "Set-Cookie" header is present and set the new value of the session ID, this page should not be cached. As then, it will be cached at all the intermdediate proxy and gateways.

  • Thanks very much, your answer's very helpful. Can I just ask - is the session id always available in the form of a HTTP header? It seems cookie is, but my understanding is that cookie is not the only mechanism for persistent session IDs. I'm still a little bit stuck on how to (reliably) extract the session ID from my request every time. – user81147 Oct 20 '16 at 14:57
  • I am not sure if I understood your question correctly. Yes, the cookie will be available in headers at least with every request and it can be present in response too when the new value is set. There is no point in sending the cookie value in the body of the response as session IDs should be kept secret. (Again there are cases where you can put session id in the response to stop CSRF, but that is a different story). – one Oct 21 '16 at 5:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy