Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-sess-04
Testing for Exposed Session Variables
Passed 21 of 22 test cases with the skill, and 18 of 22 without it.
and 1 more in the full report
4 fixed17 passed either way0 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
We need to audit our web portal to ensure session identifiers aren't being leaked in client-side storage or HTTP responses. Please provide bash curl snippets and browser console JavaScript to check for session keys in localStorage/sessionStorage, test error responses for leaked tokens, and verify URL redirect parameters after login.
| Checked | Without skill | With skill |
|---|---|---|
| iterates through keys in both localStorage and sessionStorage to inspect key names | Passed | Passed |
| tests error response leakage using curl with manipulated session cookie payloads | Passed | Passed |
| inspects HTTP headers for session parameters like jsessionid or PHPSESSID | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-SESS-04
Testing for Exposed Session Variables
Session variables may be exposed through various channels including URLs, error messages, logs, HTTP headers, or client-side storage. Exposure of session tokens or sensitive session data can lead to session hijacking, information disclosure, or account takeover. This test identifies instances where session-related information is unintentionally disclosed.
#!/bin/bash
TARGET="https://target.com"
# Check for session in URL after login
response=$(curl -sI -X POST "$TARGET/login" \
-d "username=test&password=test" \
-L 2>&1)
test cases passed, vs 18 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.