Harden Weak Session IDs Low

[r1kka6]

Summary

• replace the predictable low-level dvwaSession counter with a cryptographically random 256-bit value
• scope and harden the generated cookie with Secure, HttpOnly, SameSite=Strict, and a challenge-specific path

Verification

• docker run --rm -v "$PWD":/app dvwa-ctf-xss-reflected-low php -l /app/vulnerabilities/weak_id/source/low.php
• docker build -t dvwa-ctf-weak-session-id-low .
• compared two POSTs to /vulnerabilities/weak_id/ against baseline and patched containers: baseline returned dvwaSession=1 then dvwaSession=2; patched returned distinct 64-hex values with hardened cookie flags