Session randomness analysis with Burp Suite sequencer
Users of web applications are identified by session IDs. An attacker can impersonate users when generated sessions are predictable. This article introduces Burp Suite Sequencer and shows how it can be used to analyze session randomness.
Burp suite sequencer
The sequencer is part of Burp Suite, which is an integrated platform for web site security testing [1]. Burp Suite Sequencer is helpful when analyzing session randomness.
Let’s describe how to perform this analysis. The penetration tester intercepts the request (with Burp Suite Proxy) for which the response includes the session ID. Then the request is sent to Burp Suite Sequencer. After that, the penetration tester needs to choose the field in the response for which randomness will be analyzed (session ID in this example). Burp Suite Sequencer is launched. At least 100 requests need to be sent so that Burp Suite Sequencer can perform the analysis.
Target
DVWA (Damn Vulnerable Web Application) is a web application that is intentionally vulnerable [2]. It is helpful for those who want to play with web application security stuff. DVWA is part of Metasploitable.
Metasploitable is a Linux-based virtual machine that is intentionally vulnerable [3]. It can be used, for example, to practice penetration testing skills. Please remember that this machine is vulnerable and should not operate in bridge mode.
This article shows how to analyze the randomness of session IDs generated by DVWA.
Request interception
When the penetration tester visits DVWA for the first time, the following request is sent (intercepted with Burp Suite Proxy).
Let’s analyze the response to this request.
As we can see, the cookie with PHPSESSID is set. Now the penetration tester is going to send the request many times and analyze the values of PHPSESSID in the responses. There is no need to do it manually. It can be done automatically with Burp Suite Sequencer.
Sending request to Burp suite sequencer
Right-click right on the intercepted request with Burp Suite Proxy and choose “Send to Sequencer.”
Launching Burp suite sequencer
The penetration tester wants to check the randomness of PHPSESSID in the response. That’s why he needs to choose it in “Token Location Within Response.” Then click “Start live capture” to launch Burp Suite Sequencer.
Burp suite sequencer—Analyzing randomness of PHPSESSID
When this tool has been launched, requests are sent and values of PHPSESSID are analyzed in the responses. The analysis can start after 100 requests (“Analyze now” button).
As we can see, the section “Overall result” shows information about the randomness of PHPSESSID within the sample of 189 requests. One can save the values of PHPSESSID to a file (“Save tokens” button; the result is shown below).
Summary
The attacker can impersonate a user when generated sessions are predictable. This article introduced Burp Suite Sequencer and showed how to use this tool to analyze session randomness. Another application of Burp Suite Sequencer could be, for example, randomness analysis of the CSRF token.
Sources
- Burp Suite (access date: 8 January 2014)
- DVWA (Damn Vulnerable Web Application) access date: 8 January 2014)
- Metasploitable (access date: 8 January 2014)