vulns.co
/
GKData.io MCP

Session and cookie scope

Session bugs are scope, lifetime, and which cookie jar the server trusts. A parent-domain cookie, a missing Partitioned attribute, or a refresh token that survives logout is inventory until it becomes someone else's session.

Skill: Session, cookies, and passkeys

Ask: Which cookie or token does the server trust, and can recovery issue a session the primary login would not?

Stop: You can name the cookie or token, the recovery path, and whether a second browser still holds a session after logout.

Open the skill

Practice the class in the browser: PortSwigger Web Security Academy. The lab is theirs. This page is the stop condition and the disclosures.

Checklists

  • Session cookie inventory - Inventory every cookie the app sets, then decide which ones are the session. Flags, scope, and rotation matter more than the cookie name.
  • Authentication / ATO - Account takeover is a chain. Inventory every step of how an identity becomes a session.

Disclosures

No public card yet.

Playbooks

  • Cookie and session binding - Decide which cookies are the session, then check scope, flags, and whether logout actually kills them. SameSite, the __Host- prefix, and Partitioned (CHIPS) are properties of that decision, not a checklist of headers.
  • Account Takeover - Chain weaknesses in auth, reset, and session flows to seize another user's account.

Tools

  • Burp Suite - The industry-standard intercepting proxy for manual web testing. Community edition is free; Pro adds the active scanner and automation.

Questions

Is a parent-domain cookie always reportable?

No. It is a gadget until a sibling host you can influence receives that cookie or can set a shadowing one. HttpOnly stops script from reading it. It does not stop the browser from sending it.

What is the Partitioned attribute?

CHIPS. Partitioned ties a cookie to the top-level site. Chrome did not complete a universal third-party cookie shutdown, so in 2026 a normal Chrome profile can still send an unpartitioned third-party cookie. Incognito, Safari, Firefox, and enterprise policy often do not. Name the browser and the setting you observed.

This page is the linked pack hunt_brief("session") returns on the MCP connector. Authorized testing only.