Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-sess-02
Testing for Cookies Attributes
Passed 17 of 22 test cases with the skill, and 14 of 22 without it.
and 2 more in the full report
4 fixed13 passed either way4 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
During a web application security assessment, an auditor finds that the primary session cookie JSESSIONID is issued over HTTPS but lacks the Secure attribute, allowing browsers to send it over unencrypted HTTP requests if a user navigates to http://. What CVSS v3 score and severity level should be assigned to this vulnerability based on standard OWASP WSTG risk assessment criteria?
| Checked | Without skill | With skill |
|---|---|---|
| Identify the CVSS base score as 7.5. | Missed | Passed |
| Categorize the severity level as High. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-SESS-02
Testing for Cookies Attributes
Cookie attributes control how browsers handle cookies, including security restrictions. Improperly configured cookie attributes can expose session tokens to theft via XSS attacks, man-in-the-middle attacks, or cross-site request forgery. This test examines whether cookies are configured with appropriate security attributes including Secure, HttpOnly, SameSite, Domain, Path, and Expires/Max-Age.
| Attribute | Missing Impact |
|---|---|
| Secure | Token sent over HTTP |
| HttpOnly | XSS can steal token |
| SameSite | CSRF attacks possible |
| Proper Domain | Subdomain attacks |
| Proper Path | Broader exposure |
test cases passed, vs 14 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.