1. Introduction

Users of web applications are identified by session IDs. An attacker can impersonate users when generated sessions are predictable. This article introduces Burp Suite Sequencer and shows how it can be used to analyze session randomness.

2. Burp Suite Sequencer

The sequencer is part of Burp Suite, which is an integrated platform for web site security testing [1]. Burp Suite Sequencer is helpful when analyzing session randomness.

Let’s describe how to perform this analysis. The penetration tester intercepts the request (with Burp Suite Proxy) for which the response includes the session ID. Then the request is sent to Burp Suite Sequencer. After that, the penetration tester needs to choose the field in the response for which randomness will be analyzed (session ID in this example). Burp Suite Sequencer is launched. At least 100 requests need to be sent so that Burp Suite Sequencer can perform the analysis.

3. Target

DVWA (Damn Vulnerable Web Application) is a web application that is intentionally vulnerable [2]. It is helpful for those who want to play with web application security stuff. DVWA is part of Metasploitable.

Metasploitable is a Linux-based virtual machine that is intentionally vulnerable [3]. It can be used, for example, to practice penetration testing skills. Please remember that this machine is vulnerable and should not operate in bridge mode.

This article shows how to analyze the randomness of session IDs generated by DVWA.

4. Request Interception

When the penetration tester visits DVWA for the first time, the following request is sent (intercepted with Burp Suite Proxy).

Let’s analyze the response to this request.

As we can see, the cookie with PHPSESSID is set. Now the penetration tester is going to send the request many times and analyze the values of PHPSESSID in the responses. There is no need to do it manually. It can be done automatically with Burp Suite Sequencer.

5. Sending Request to Burp Suite Sequencer

Right-click right on the intercepted request with Burp Suite Proxy and choose “Send to Sequencer.”

Want to learn more?? The InfoSec Institute Ethical Hacking course goes in-depth into the techniques used by malicious, black hat hackers with attention getting lectures and hands-on lab exercises. While these hacking skills can be used for malicious purposes, this class teaches you how to use the same hacking techniques to perform a white-hat, ethical hack, on your organization. You leave with the ability to quantitatively assess and measure threats to information assets; and discover where your organization is most vulnerable to black hat hackers. Some features of this course include:

  • Dual Certification - CEH and CPT
  • 5 days of Intensive Hands-On Labs
  • Expert Instruction
  • CTF exercises in the evening
  • Most up-to-date proprietary courseware available

6. Launching Burp Suite Sequencer

The penetration tester wants to check the randomness of PHPSESSID in the response. That’s why he needs to choose it in “Token Location Within Response.” Then click “Start live capture” to launch Burp Suite Sequencer.

7. Burp Suite Sequencer—Analyzing Randomness of PHPSESSID

When this tool has been launched, requests are sent and values of PHPSESSID are analyzed in the responses. The analysis can start after 100 requests (“Analyze now” button).

As we can see, the section “Overall result” shows information about the randomness of PHPSESSID within the sample of 189 requests. One can save the values of PHPSESSID to a file (“Save tokens” button; the result is shown below).

8. Summary

The attacker can impersonate a user when generated sessions are predictable. This article introduced Burp Suite Sequencer and showed how to use this tool to analyze session randomness. Another application of Burp Suite Sequencer could be, for example, randomness analysis of the CSRF token.

References:

[1] Burp Suite http://portswigger.net/burp/ (access date: 8 January 2014)

[2] DVWA (Damn Vulnerable Web Application) http://www.dvwa.co.uk/ (access date: 8 January 2014)

[3] Metasploitable http://www.offensive-security.com/metasploit-unleashed/Metasploitable (access date: 8 January 2014)