Session Hijacking Lab 1

Session Hijacking Lab

PHP Session Hijacking Lab

Controlled lab only. This plugin uses a PHP session as the lab authentication state so students can observe session-ID behavior.

This is a separate training mechanism. It does not log the browser into WordPress’s normal wp-admin/account session.

Current Server-Side Session

Session namePHPSESSID
Server sees session ID
0am0p4g33r1mpd1db6hcic0cku
AuthenticatedNO
Lab userAnonymous
Cookie sent by browser0am0p4g33r1mpd1db6hcic0cku

1. Lab Login

3. Controlled Exercise

  1. Use two isolated browser profiles, A and B.
  2. In A, log in and record the PHPSESSID shown above.
  3. In B, set its PHPSESSID cookie to the existing session ID from A.
  4. Reload the lab page in B.
  5. In vulnerable mode, the server should load the same server-side session and therefore display the same lab profile.
  6. In secure mode, authentication rotates the session ID, so the old identifier no longer represents the newly authenticated session.

Important diagnostic: compare “Cookie sent by browser” with “Server sees session ID”. They should be identical after reload. If they differ, the browser is not sending the cookie you edited.