Project 20: Cookies and Sessions

Module: Module 2: OSINT, Social-Engineering Awareness & Traffic Analysis  |  Level: Beginner  | 
Primary tool: Browser DevTools + Burp Suite Community  |  Estimated time: 45–75 minutes

Objective: Understand session-token issuance, attributes (HttpOnly/Secure/SameSite) and hijacking risk.

Free lab environment

PortSwigger Web Security Academy + OWASP Juice Shop — https://portswigger.net/web-security and https://owasp.org/www-project-juice-shop/

PortSwigger’s Web Security Academy is 100% free (no paid tier required) and gives you an isolated, disposable vulnerable lab instance for every topic. For projects that need a full application to explore end-to-end, run OWASP Juice Shop locally with `docker run -p 3000:3000 bkimminich/juice-shop` (free, open-source, built by OWASP specifically to be broken).

Lab workflow

1. Open the lab environment (PortSwigger Web Security Academy 'Session hijacking' materials) and read the challenge description in full before touching anything.
2. Using Browser DevTools + Burp Suite Community, explore the application’s normal, intended behavior first — you cannot recognize an anomaly without a baseline.
3. Attempt to understand session-token issuance, attributes (HttpOnly/Secure/SameSite) and hijacking risk, adjusting your input methodically (change one variable at a time) rather than guessing randomly.
4. The moment you get a signal the technique is working, stop and capture evidence before pushing further — over-testing a confirmed finding wastes time and risk for no additional proof.
5. Write the exact remediation for the specific code pattern involved — ‘sanitize input’ is not sufficient; name the actual fix (parameterization, encoding, allow-listing, etc.).
6. If the lab platform offers a ‘solved’ confirmation, capture that as supporting evidence alongside your own screenshots.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• DevTools’ Application/Storage tab showing a session cookie’s attributes
• your written assessment of whether the cookie you inspected is missing any recommended flag

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.