Zapotek/arachni — Issue #140: Suggested Checks: Cookies
Author: ChrisJohnRiley
Created: 2012-01-10 14:10:12+00:00
State: open

Arachni doesn't seem to alert on the following vulnerabilties .:

- Session Fixation

Note: The Proxy picks up 4 Cookie when you first visit Login.php (prior to login --> DVWA testbed), and after logon it doesn't pick up any further Cookies. I checked and the app doesn't alter the cookie after login. Not sure if Arachni checks for this logic, but it's a session fixation issue (cookie value not altered after logon).

- Cookies without HTTPOnly set (probably also Secure Flag --> untested)