Session Hijacking

1. What a Session Token Is

The browser’s “already logged in” string is a secret.

2. How Sessions Get Stolen (Concepts)

XSS, open Wi-Fi, missing flags — not a hijack PoC.

3. Cookie Flags and Logout Hygiene

Secure, HttpOnly, SameSite, short TTL, revoke on password change.

4. Lab — Inspect Cookie Flags on a Site You Own

DevTools on YOUR app or a local page you wrote — not intercepting others.

5. Quiz — Session Hijacking

10 APPLY questions on tokens and cookie flags.