The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

or other information. Look for sequences ending in an equals sign and/or

only containing the other valid Base64 characters: a–z, A–Z, 0–9, +, and /. 

■

If any meaning can be reverse engineered from the sample of session

tokens, consider whether you have sufficient information to attempt to

guess the tokens recently issued to other application users. Find a page

of the application that is session-dependent (e.g., one that returns an

error message or a redirect elsewhere if accessed without a valid ses-

sion), and use a tool such as Burp Intruder to make large numbers of

requests to this page using guessed tokens. Monitor the results for any

cases where the page is loaded correctly, indicating a valid session token.

Predictable Tokens

Some session tokens do not contain any meaningful data associating them

with a particular user but are nevertheless guessable because they contain

sequences or patterns that allow an attacker to extrapolate from a sample of

tokens to find other valid tokens recently issued by the application. Even if the

extrapolation involves an amount of trial and error (for example, one valid