Session Hijacking Lab 1

Session Hijacking Lab

PHP Session Hijacking Lab

Controlled lab only. This plugin uses a PHP session as the lab authentication state so students can observe session-ID behavior.

This is a separate training mechanism. It does not log the browser into WordPress’s normal wp-admin/account session.

1. Lab Login

3. Controlled Exercise

  1. Use two isolated browser profiles, A and B.
  2. In A, log in and record the PHPSESSID shown above.
  3. In B, set its PHPSESSID cookie to the existing session ID from A.
  4. Reload the lab page in B.
  5. In vulnerable mode, the server should load the same server-side session and therefore display the same lab profile.
  6. In secure mode, authentication rotates the session ID, so the old identifier no longer represents the newly authenticated session.

Important: use browser developer tools to inspect the PHPSESSID cookie. The lab intentionally does not display the session ID in the page UI.