Collected research

Session Puzzling

Google Code Archive - Long-term storage for Google Code Project Hosting.

The Google Code download index for PuzzleMall, Shay Chen's deliberately vulnerable Java web application for practising session puzzling and temporal session race conditions. It lists the session puzzling whitepaper and both conference decks, the SessionKeepAlive connection-pool exhaustion tool, and Derby and MySQL builds of the app.

Record

Document

Google Code Archive - Long-term storage for Google Code Project Hosting.

Published by

code.google.com

Topic

Identity

In the archive

• Collected in the 2011 research round

Related sources

• Session Puzzles Indirect Application Attack Vectors May 2011 Whitepaper Whitepaper
• Bypassing Restrictions in Multiphase Processes via Session Puzzling HD Recording
• Session Puzzling via Redirection Prevention HD Recording
• User Impersonation via Session Puzzling HD Recording
• Authentication Bypass via Session Puzzling HD Recording

Tags

• tooling
• race-condition
• session-fixation
• auth-bypass
• java
• dos
• owasp-a01-2021
• owasp-a04-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of code.google.com, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.