Session Hijacking Lab 1

Session Hijacking Lab

PHP Session Hijacking Lab

Controlled lab only. This plugin uses a PHP session as the lab authentication state so students can observe session-ID behavior.

This is a separate training mechanism. It does not log the browser into WordPress’s normal wp-admin/account session.

Current Server-Side Session

Session namePHPSESSID
Server sees session ID
93i5an82k1plc1je8sjpdrg3tj
AuthenticatedNO
Lab userAnonymous
Cookie sent by browsernot present

1. Lab Login

3. Controlled Exercise

  1. Use two isolated browser profiles, A and B.
  2. In A, log in and record the PHPSESSID shown above.
  3. In B, set its PHPSESSID cookie to the existing session ID from A.
  4. Reload the lab page in B.
  5. In vulnerable mode, the server should load the same server-side session and therefore display the same lab profile.
  6. In secure mode, authentication rotates the session ID, so the old identifier no longer represents the newly authenticated session.

Important diagnostic: compare “Cookie sent by browser” with “Server sees session ID”. They should be identical after reload. If they differ, the browser is not sending the cookie you edited.