Hacking

Session randomness analysis with Burp Suite sequencer

Users of web applications are identified by session IDs. An attacker can impersonate users when generated sessions are predictable. This article introduces Burp Suite Sequencer and shows how it can be used to analyze session randomness.

Earn two pentesting certifications at once!

Enroll in one boot camp to earn both your Certified Ethical Hacker (CEH) and CompTIA PenTest+ certifications — backed with an Exam Pass Guarantee.

View Pricing

Burp suite sequencer

The sequencer is part of Burp Suite, which is an integrated platform for web site security testing [1]. Burp Suite Sequencer is helpful when analyzing session randomness.

Let's describe how to perform this analysis. The penetration tester intercepts the request (with Burp Suite Proxy) for which the response includes the session ID. Then the request is sent to Burp Suite Sequencer. After that, the penetration tester needs to choose the field in the response for which randomness will be analyzed (session ID in this example). Burp Suite Sequencer is launched. At least 100 requests need to be sent so that Burp Suite Sequencer can perform the analysis.

Target

DVWA (Damn Vulnerable Web Application) is a web application that is intentionally vulnerable [2]. It is helpful for those who want to play with web application security stuff. DVWA is part of Metasploitable.

Metasploitable is a Linux-based virtual machine that is intentionally vulnerable [3]. It can be used, for example, to practice penetration testing skills. Please remember that this machine is vulnerable and should not operate in bridge mode.

This article shows how to analyze the randomness of session IDs generated by DVWA.

Request interception

When the penetration tester visits DVWA for the first time, the following request is sent (intercepted with Burp Suite Proxy).

Let's analyze the response to this request.

As we can see, the cookie with PHPSESSID is set. Now the penetration tester is going to send the request many times and analyze the values of PHPSESSID in the responses. There is no need to do it manually. It can be done automatically with Burp Suite Sequencer.

Sending request to Burp suite sequencer

Right-click right on the intercepted request with Burp Suite Proxy and choose "Send to Sequencer."

Launching Burp suite sequencer

The penetration tester wants to check the randomness of PHPSESSID in the response. That's why he needs to choose it in "Token Location Within Response." Then click "Start live capture" to launch Burp Suite Sequencer.

Burp suite sequencer—Analyzing randomness of PHPSESSID

When this tool has been launched, requests are sent and values of PHPSESSID are analyzed in the responses. The analysis can start after 100 requests ("Analyze now" button).

As we can see, the section "Overall result" shows information about the randomness of PHPSESSID within the sample of 189 requests. One can save the values of PHPSESSID to a file ("Save tokens" button; the result is shown below).

Summary

The attacker can impersonate a user when generated sessions are predictable. This article introduced Burp Suite Sequencer and showed how to use this tool to analyze session randomness. Another application of Burp Suite Sequencer could be, for example, randomness analysis of the CSRF token.

Become a Certified Ethical Hacker, guaranteed!

Get training from anywhere to earn your Certified Ethical Hacker (CEH) Certification — backed with an Exam Pass Guarantee.

Learn More

Sources

• Burp Suite (access date: 8 January 2014)
• DVWA (Damn Vulnerable Web Application) access date: 8 January 2014)
• Metasploitable  (access date: 8 January 2014)