Session Timeout Test
Summary: A Burp Suite extension called Session Timeout Test, authored by August Detlefsen and version 1.0, issues the same request repeatedly with increasing delays until a configured string appears in the response, in order to determine how long a server takes to time out a session. The listing, last updated 01 July 2014, rates its estimated system impact as low and notes that extensions are written by third-party Burp users, with PortSwigger making no warranty about their quality or usefulness.
Bottom line: A session that stays alive longer than expected is a window an attacker can reuse; this extension exists to measure that window against a string you define, so the finding is only as good as the timeout marker you configure.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026