New answers tagged session-management
1
If you're able to send the token in the request body, it must be stored somewhere script-accessible (probably in session or local storage). If it's stored somewhere script-accessible, then there is literally no point having the cookie be HttpOnly.
HttpOnly is only barely a security measure to begin with - for most exploitation scenarios, it might limit the ...
1
It prevents damage from a very common and low tech attack: device theft.
If my laptop walks away while i'm in the potty, I'd rather the thief have just 5 mins to flee and hide and start hacking than my online access being available to the more savy fence it's pawned to hours, days, or weeks later...
0
If the session IDs are indeed encrypted due to HTTPS, are we still
able to determine if the session IDs are sufficiently random and
unpredictable? I was asking myself this question and for me, a close
and probable answer I would give myself, is no. (I might be wrong)
To read the session ID used by an application, you don't necessarily need any tool ...
0
If the session IDs are sufficiently random and unpredictable?
To check just for randomisation and unpredictability, I use myself Burp Suite - Sequencer.
Burp Suite Community edition is free to use.
You would actually need to have access to the internal web application code?
Sequencer can make any request where in response you get ID you want to check. ...
Top 50 recent answers are included
