Suppose a website is logging out the user after some time to re-create the session and start using the website. As the security tester, how will you handle this situation? Isn't it frustrating? Yes! looking from a security perspective this is a nice mechanism, but if you are a penetration tester, how will you handle this, will you just simply get login again and again, or you will do something else to get rid of it?


Burp has session handling functionality that allows you to make a request to check if your session is valid, and if it has expired then it will login again. You can find it in the Project Options > Sessions tab.

Official documentation is here: https://portswigger.net/support/configuring-burp-suites-session-handling-rules

  • Yeah, that helps. Thanks for answering :)) – AWS Learning Feb 15 at 10:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.