Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-sess-07
Testing for Session Timeout
Passed 22 of 22 test cases with the skill, and 20 of 22 without it.
2 fixed20 passed either way0 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
A web application refreshes session validity on every API request but lacks an overarching maximum lifetime limit (absolute timeout). What CVSS v3 score is associated with this missing absolute session expiration vulnerability?
| Checked | Without skill | With skill |
|---|---|---|
| The response provides the CVSS score 5.3. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-SESS-07
Testing for Session Timeout
Session timeout controls how long a session remains valid after periods of inactivity or absolute time limits. Improper timeout configuration can leave sessions vulnerable to hijacking if users don't explicitly logout, especially on shared computers or public networks.
#!/bin/bash
TARGET="https://target.com"
# Get session
session=$(curl -s -c - -X POST "$TARGET/login" \
-d "username=test&password=test" | grep -oP "SESSIONID=\K[^;]+")
echo "Session: $session"
test cases passed, vs 20 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.