Session Register
session_registerRegisters an authenticated session (cookies/headers) to one host for later test phases. Two roles enable authorization checks; credentials are masked and stored in the workspace.
Instructions
Register an authenticated session for later phases to use.
cookies takes sid=abc; csrf=def. headers takes
Authorization: Bearer xyz (semicolon or newline separated).
host is mandatory and is enforced: a session is only ever attached to
that host or its subdomains. Sending an operator's cookie to a host it was
not issued for is a credential leak, and guessing is how that happens.
role is free text — "admin", "user-a", "user-b". Register two
accounts of differing privilege and authz_compare can test authorization
properly; one account only tests that the application works.
Nothing here creates an account. Self-registration is a policy question: some programs invite it, others are silent, and silence is not permission. Read the program's rules, register by hand, then bring the session here.
Values are masked in every result, log and audit entry. The store lives in the engagement workspace, which is gitignored, mode 0600.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| name | Yes | ||
| note | No | ||
| role | No | user | |
| cookies | No | ||
| headers | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||