Harden A07 Weak Session IDs Low

[tobymoreno]

Mapping

• challenge: Challenge-9-Weak-Session-IDs-Low
• OWASP category: A07:2025 Authentication Failures
• vulnerable snippet: incrementing session counter used directly as dvwaSession
• source evidence: help text states the cookie value is very obviously predictable

Summary

• replace the predictable counter with a 256-bit random identifier
• scope the cookie to the Weak Session IDs path
• add Secure, HttpOnly, and SameSite=Strict attributes
• add focused pytest metadata and assertions for the vulnerable snippets and secure replacement

Verification

• focused Python checks passed
• PHP syntax check passed in Colima
• two live POST requests produced distinct 64-character hexadecimal identifiers
• both live Set-Cookie responses included expiry, scoped path, Secure, HttpOnly, and SameSite=Strict
• git diff --check passed
• signed DCO commit

This PR intentionally targets only the Low level so its CTF score identifies whether the previously incomplete cookie hardening was a remaining solve.

[github-actions]

🏆 DVWA — CTF Patch Score

░░░░░░░░░░░░░░░░░░░░  1 / 108 pts  (1%)

1 / 55 challenges patched

Per-challenge detail is withheld — it would reveal the rubric.

Commit: 3ba3372 · scoring run

🎉 Your result is on the leaderboard — see where you rank! 🏆