webPromedium

DeskFlow — Session Fixation via Support Ticket URL

hackadvisor

Task: Express.js support ticket platform where admin bot visits reference URLs; connect.sid accepts ?sid= query parameter and session ID doesn't rotate after login. Solution: Session fixation — submit ticket with reference_url pointing to http://localhost:8080/login?sid=ATTACKER_SID, admin bot authenticates with that SID, then reuse it to access /admin/dashboard.

$ ls tags/ techniques/
session_fixation_via_query_parametersession_id_no_rotationadmin_bot_url_visitlocalhost_internal_accessarbitrary_session_id_injection

🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups