Other nomination

Session Puzzling

The Google Code download index for PuzzleMall, Shay Chen's deliberately vulnerable Java web application for practising session puzzling and temporal session race conditions. It lists the session puzzling whitepaper and both conference decks, the SessionKeepAlive connection-pool exhaustion tool, and Derby and MySQL builds of the app.

In the archive

• Nominated for the 2011 Top 10 Web Hacking Techniques

Related sources

• Whitepaper
• Video: Bypassing Restrictions in Multiphase Processes
• Video: Session Puzzling via Redirection Prevention
• Video: User Impersonation via Session Puzzling
• Video: Authentication Bypass via Session Puzzling

Tags

• tooling
• race-condition
• session-fixation
• auth-bypass
• java
• dos
• owasp-a01-2021
• owasp-a04-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.