Determining the session timeout - Port Swigger
Summary: PortSwigger Research describes a method for measuring how long an application takes to time out a session: Burp Intruder issues the same request repeatedly with increasing delays set in the resource pool's "Delay between requests" option, using increments of a chosen number of milliseconds. The article notes that a longer timeout gives an attacker more time to use or guess a session token, and that the technique lets testers check compliance with standards requiring applications to time out within a specified period.
What's compelling: Every extra minute before a session expires is extra time an attacker holding a stolen or guessed session token can keep using it, so the timeout value is a direct measure of exposure rather than a formality.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026