Re: Session ID Analysis

[Michal Zalewski <lcamtuf () coredump cx>]

> thanks portswigger. I will do that. All im looking for is a scientific
> way of indeed proving the non randomness of the token and if possible
> even predict next tokens.

For a more thorough set of tests, you may want to check out an old
tool of mine, stompy:

http://lcamtuf.coredump.cx/soft/stompy.tgz

But there really is no way around simply spending some time to
understand how these tools work and what their output means in a
particular context.

/mz

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified. 

http://www.iacertification.org
------------------------------------------------------------------------