Maintaining an authenticated session - Port Swigger
Summary: PortSwigger's guide describes how Burp Suite users can configure a session handling rule so the scanner or Intruder automatically logs back in when an application terminates a session, for example after suspicious input triggers a logout. The rule inspects responses for an invalid-login expression, such as the 302 redirect to /login on the ginandjuice.shop demo site, and then runs a recorded macro of the login requests to refresh session cookies.
Key Takeaway: Automated testing that stops the moment an application logs you out leaves fuzzing and scanning incomplete, so a rule that detects the invalid-session response and replays the login sequence is what keeps the test coverage from silently collapsing.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026