diff --git a/test/test_sessions_url.py b/test/test_sessions_url.py
new file mode 100644
index 0000000..83ca2a7
--- /dev/null
+++ b/test/test_sessions_url.py
@@ -0,0 +1,57 @@
+
+import unittest
+import sys
+
+import tutil
+import webvulnscan.attacks.session_url
+
+#session id's in URL can appear in various forms
+#this test creates forms of sid, sessionid, phpsessid
+
+
+def make_client(headers):
+ headers['Content-Type'] = 'text/html; charset=utf-8'
+ return tutil.TestClient({
+ '/': b'''(200, b'', headers)''',
+ })
+
+
+class SessionUrl(unittest.TestCase):
+ #creating site without any session
+ def test_static_site(self):
+ client = make_client({})
+ client.run_attack(webvulnscan.attacks.session_url)
+ client.log.assert_count(0)
+
+ #sid in link
+ def test_site_with_post(self):
+ client = tutil.TestClient({
+ '/': u'''
+ link1
+ '''
+ })
+ client.run_attack(webvulnscan.attacks.session_url)
+ client.log.assert_count(1)
+
+ #sessionid in link
+ def test_site_with_get(self):
+ client = tutil.TestClient({
+ '/': u'''
+ link2
+ '''
+ })
+ client.run_attack(webvulnscan.attacks.session_url)
+ client.log.assert_count(1)
+
+ #phpsessid in link
+ def test_site_with_get(self):
+ client = tutil.TestClient({
+ '/': u'''
+ link3
+ '''
+ })
+ client.run_attack(webvulnscan.attacks.session_url)
+ client.log.assert_count(1)
diff --git a/webvulnscan/attacks/__init__.py b/webvulnscan/attacks/__init__.py
index 4af52c1..85dbfc0 100644
--- a/webvulnscan/attacks/__init__.py
+++ b/webvulnscan/attacks/__init__.py
@@ -6,7 +6,8 @@
from .clickjack import clickjack
from .cookiescan import cookiescan
from .exotic_characters import exotic_characters
+from .session_url import session_url
def all_attacks():
- return [xss, csrf, crlf, breach, clickjack, cookiescan, exotic_characters]
+ return [xss, csrf, crlf, breach, clickjack, cookiescan, exotic_characters, session_url]
diff --git a/webvulnscan/attacks/session_url.py b/webvulnscan/attacks/session_url.py
new file mode 100644
index 0000000..1dbff4e
--- /dev/null
+++ b/webvulnscan/attacks/session_url.py
@@ -0,0 +1,19 @@
+from ..utils import attack
+
+
+def check_id(page):
+ if "sid" in page.url:
+ return true
+ if "sessionid" in page.url:
+ return true
+ if "phpsessid" in page.url:
+ return true
+ return false
+
+
+@attack()
+def session_url(client, log, page):
+ #session id in url found
+ if check_id(page):
+ log('vuln', page.url, u"Session ID in URL")
+ return