WSTG Session Tester

Python framework to evaluate session controls aligned with OWASP WSTG 4.6 (schema, cookie attributes, fixation, timeout, CSRF, logout, puzzling, hijacking, JWT, concurrent sessions).

For authorized targets only.

Features (planned)

• Cookie flags: HttpOnly, Secure, SameSite
• Session fixation checks
• Timeout/idle enforcement
• JWT claim lints (exp/iat/aud/iss, alg)
• CSRF detector (form + header)
• Concurrent session policy probes

Dev

python -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
pytest -q

CLI

wstg-session-tester --target https://example.local --auth bearer:TOKEN

Legal

Educational use only with explicit authorization.