Sign in

Your session ID is assigned before login and not rotated after authentication.

Credentials: demo / demo123

Test harness: /victim-login?sid=SESSION_ID simulates an administrator signing in with a session ID you supply. It stands in for the phishing step of the attack, which is out of scope here.