Attacking session management

Authentication and session management make up all aspects of handling user authentication and managing active sessions. With regards to web applications, a session is the length of time users spend on a website. Best practice is managing authorized sessions (that is, what you are permitted to access), based on how people and devices authenticate as well as, controlling what and how long resources are available during the active session. This makes authentication a key aspect of managing authorized sessions.

The goal for a Penetration Tester is to identify accounts that are permitted access to sessions with high-level privileges, and unlimited time to access the web application. This is why session management security features, such as session timeout intervals and SSL certificates, were created. Either way, tools available in Kali can identify flaws in how sessions are managed, such as capturing an active session on a web application post user logout, and using...