Description
the one thing everybody knows to do. Does that actually evict the attacker?
In almost every case in this kit the application works perfectly, including for the attacker. A session that survives logout looks exactly like a session that did not need to be logged out. No crash, no error, no wrong total — just a system quietly not doing something it was never asked to do.
**Every defect is verified.** All 18 were confirmed by running them — each fires when armed
and passes when disarmed. That check is the expensive part, and it is the part a generated
case list does not have.
What is inside
The playbook, 28 pages. The four questions that find most identity defects, an anatomy of an account takeover using six real case IDs, and twelve areas from registration through to federated sign-in.
The case bank, 93 cases. Filterable spreadsheet with severity ratings, plus an error message map, a token and session reference, a bug report template and a client sign-off sheet.
The practice sandbox. 18 switchable defects — enumeration, PIN leakage, sessions surviving a password change, MFA bypass, broken object-level authorization.
The free 45-minute smoke test. Eighteen checks, three of them marked critical.
Who it is for. Any product with a login — especially one with sessions, password reset or multi-factor.
How this differs from Juice Shop and DVWA
Those are excellent, free, and built for a different job — they teach you to attack an application. This teaches you to test one.
Juice Shop will not show you a subscription that keeps billing after cancellation, a proration that ignores an active discount, or an AI feature that refuses a legitimate question. And it has no switch: you cannot disarm a defect and confirm the same check now passes, which is where most of the learning is.