Session cookie inventory
Decide which cookies are the session and whether logout, rotation, and scope match that decision.
Level: intermediate
Tools: Burp Suite, browser devtools
Pipeline
Walk login, refresh, and logout on {url}, list every Set-Cookie with its flags and Domain, and note whether the pre-logout value is still accepted.