Skip to content

Add offensive-session-fixation skill - #57

Open
rudycelekli wants to merge 1 commit into
SnailSploit:mainfrom
rudycelekli:skill/offensive-session-fixation
Open

rudycelekli wants to merge 1 commit into
SnailSploit:mainfrom
rudycelekli:skill/offensive-session-fixation

Conversation

@rudycelekli

Copy link
Copy Markdown

Summary

  • Adds an authorized-assessment skill for session fixation, separate from the CSRF and XSS skills.
  • Covers pre-auth identifier reuse, session ids in URLs, cookie flags, and rotation on privilege change.
  • Updates the skill index, changelog, and generated manifest.

Test plan

  • python3 tools/build_manifest.py reports skill_count 80 and includes offensive-session-fixation once

`offensive-session-fixation` (auth) — session fixation: pre-authentication identifiers that survive login, session ids in URLs, and rotation on privilege change.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant