#1716·katana

Headless cannot verify locations with a clean session rewalk

Author: Mzack9999Created Jul 17, 2026Updated Jul 27, 2026

Burp rewalks from the entry with a cleared session to tell match vs app change vs session side-effect. Katana can restore state along a path but does not clear cookies/storage and replay a sample of paths after the crawl, so the map can drift without detection.

Add ClearSession, a rewalk runner that classifies outcomes (match, app_change, session_fork, non_deterministic), and optional post-crawl sampling controlled by RewalkSample.