# Session Fixation (CTF challenge)

> The HelpDesk Portal lets you choose your own session id and never rotates it on login. Fix a session id, get an admin to authenticate on it (support reviews links you send), then reuse that same id —…

Canonical: https://codelivly.com/ctf/challenges/session-fixation

| | |
|---|---|
| Category | Web Exploitation |
| Difficulty | Medium |
| Points | 700 |
| Estimated time | 30 min |
| Type | Live instance |
| Solves | 34 |
| Author | Codelivly |

The HelpDesk Portal lets you choose your own session id and never rotates it on login. Fix a session id, get an admin to authenticate on it (support reviews links you send), then reuse that same id — now an admin session — to read the flag. Your own isolated instance; the flag is unique to you. The admin password is random, so guessing won't help.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)