The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Sometimes when tokens are created based on the output of a pseudo-

random number generator, developers decide to construct each token by

concatenating together several sequential outputs from the generator. The

perceived rationale for this is that it creates a longer, and therefore “stronger”

token. However, this tactic is usually a mistake. If an attacker can obtain

several consecutive outputs from the generator, this may enable them to infer

some information about its internal state, and may in fact make it easier for

them to extrapolate the generator’s sequence of outputs, either forward or

backward.

HACK STEPS

■

First, determine when and how session tokens are issued by walking

through the application from the first application page through any login