Session management and broken authentication

TryHackMe rooms

• Session Management
• Broken Authentication

Corresponding practice

• On the authorised targets, capture requests before login, after login, and after logout.
• Compare cookies or tokens for flags, lifetime, rotation, and invalidation behaviour.
• Use two test users to verify whether identity and authorisation are enforced server-side.
• Build a table separating authentication failures from session-management failures.

Evidence to capture

• Sanitised session lifecycle table
• One Burp request comparison
• Recommended control for each confirmed weakness

What I learned

Explain the difference between proving identity and maintaining an authenticated session.

Problems and dead ends

Record any result that could not be reproduced consistently.

What I will revisit

Choose one session test to repeat from memory.