Session fixation across the login boundary

Check whether the pre-login session identifier survives authentication. If it does, set a known id in the victim’s browser, wait for them to log in, and reuse it.

# capture the cookie before and after login; they must differ
curl -c pre.txt https://target/login
# ... perform login reusing pre.txt ...
diff <(grep session pre.txt) <(grep session post.txt)

Plant the id via a subdomain or a permissive Set-Cookie path.

Set-Cookie: session=attacker_known; Domain=.target.com; Path=/

Pro note: the fix is regenerating the session id on privilege change. Fixation is often exploitable via a subdomain that can write parent-domain cookies, so review cookie Domain scoping and whether any subdomain is attacker-influenced.