🔐 07 — Authentication Bypass

Easy

Easy Medium Hard

0/3 solved

🪪 Hard — Session Fixation

The session ID can be set before login and is not regenerated after authentication. Set a known session ID, trick an admin into logging in, then reuse their session.

Current session ID: not set
Set via: ?sid=YOUR_CHOSEN_ID

Set your session via ?sid=attacker123, then log in as admin. The session ID stays the same — proving session fixation. The flag triggers when you log in as admin with a pre-set session ID.