AppSec Cheat Sheet: Session Management

### Executive Summary: This document is a practical session-management testing cheat sheet focused on cookie-based sessions, providing step-by-step test procedures (identify session tokens, uniqueness, randomness/statistical analysis, character/bit modification, idle/absolute timeouts, logout/invalidation, fixation, session puzzling, token disclosure, cookie security attributes, and token-exchange considerations) and tool recommendations (e.g., Burp Suite) to help penetration testers assess and remediate session-related security weaknesses.