Old Sessions — PicoCTF 2026 Web Exploitation Write-up

Introduction

In this challenge, I discovered an Insecure Session Management vulnerability.

The application was exposing active session information through the /sessions endpoint. This information could be used to access another user's session, including the admin session.

The main goal was to understand how the application manages user sessions and whether the exposed session information could lead to unauthorized access.

Note: This testing was performed in an authorized PicoCTF environment.

1. Login Page

I started by opening the application. The website provided a simple login page with Username, Password, Login, and Register options.

After registering an account, I logged in as a normal user.

2. Logged In as a Normal User

After successful login, I reached the homepage as the user affan.

While checking the homepage, I noticed several comments. One comment was particularly interesting:

Hey I found a strange page at /sessions

This revealed a potentially interesting endpoint:

/sessions

I decided to investigate this endpoint to understand what information it contained.

3. Discovering the /sessions Endpoint

I navigated to:

/sessions

The page exposed information about active user sessions.

I could see session entries belonging to different users, including:

• admin
• affan

More importantly, the application was exposing their session identifiers.

This is a security issue because a session ID acts like a temporary authentication secret. If another user's valid session ID is exposed, it may allow an attacker to impersonate that user.

4. Checking the Session Cookie

Next, I opened the browser's Developer Tools and checked the application's cookies.

The application was using a cookie named:

session

The value stored inside this cookie represented my current authenticated session.

The authentication process can be understood as:

Browser → Session Cookie → Server → User Session → Authenticated User

Normally, session IDs should remain secret and should never be exposed to other users.

5. Testing the Exposed Admin Session

Since the /sessions endpoint exposed an active session associated with the admin account, I tested the impact of this exposure inside the authorized CTF environment.

The application accepted the privileged session and treated the browser as an authenticated administrator.

After refreshing the application, the homepage displayed:

Welcome admin

The challenge flag also became visible.

This confirmed that the exposed session information could lead to Session Hijacking and Authentication Bypass.

Vulnerability Analysis

The vulnerability flow was:

Normal User → Discover /sessions → Session IDs Exposed → Admin Session Identified → Session Hijacking → Admin Access

The main security problem was that the application exposed sensitive session information to an unauthorized user.

A session identifier should be treated similarly to a password because anyone possessing a valid session token may be recognized as the authenticated user.

Impact

If this vulnerability existed in a real-world application, an attacker could potentially:

• Hijack another user's session
• Bypass authentication
• Take over user accounts
• Access administrator functionality
• View sensitive information
• Perform actions with higher privileges

If an administrator's session is compromised, the impact can become critical.

Remediation

To prevent this vulnerability:

• Never expose active session IDs to users.
• Protect endpoints such as /sessions with proper authentication and authorization.
• Generate session IDs using cryptographically secure random values.
• Use HTTPS to protect session cookies during transmission.
• Set important cookie attributes such as HttpOnly, Secure, and SameSite.
• Expire sessions after an appropriate period.
• Invalidate the session when the user logs out.
• Avoid exposing debugging or internal session-management endpoints in production.

Conclusion

This challenge demonstrated the importance of secure session management.

Even if the username and password authentication mechanism is secure, exposing a valid session ID can allow an attacker to bypass the login process and impersonate another user.

The key lesson from this challenge is:

Session IDs should be protected like passwords.

Vulnerability: Insecure Session Management / Session Exposure Attack: Session Hijacking Impact: Authentication Bypass → Admin Access Environment: PicoCTF / Authorized CTF Environment

Follow me for more cybersecurity write-ups, CTFs, and AppSec content.