Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-sess-08
Testing for Session Puzzling
Passed 14 of 21 test cases with the skill, and 10 of 21 without it.
and 5 more in the full report
5 fixed10 passed either way7 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are completing a penetration test report for a session variable overloading issue found during registration flow testing. What specific Common Weakness Enumeration ID applies to this defect category?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies CWE-488 as the relevant weakness ID | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-SESS-08
Testing for Session Puzzling (Session Variable Overloading)
Session puzzling occurs when session variables are used for multiple purposes across different application flows. Attackers can manipulate session state in one flow to affect behavior in another, potentially bypassing authentication or authorization controls.
# Track session variables across different flows
# 1. Login flow
# 2. Registration flow
# 3. Password reset flow
# 4. Account verification flow
# Look for common session variables:
# - user_id, email, username
# - authenticated, verified
test cases passed, vs 10 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.