dan is conducting penetration testing and has found a vulnerability in a web application which gave him the sessionid