From 12715caec81055fefe672a5c1e0e1022ae3da920 Mon Sep 17 00:00:00 2001 From: Karenzz Date: Thu, 25 May 2023 19:23:38 +0200 Subject: [PATCH] Update page 'OWASP test questions_Karen' --- OWASP test questions_Karen.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/OWASP test questions_Karen.md b/OWASP test questions_Karen.md index 4ce6411..7babdeb 100644 --- a/OWASP test questions_Karen.md +++ b/OWASP test questions_Karen.md @@ -55,8 +55,8 @@ https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html ​ * Why is it important that session IDs be random, instead of sequentially assigned? -The first two reasons should be the security and privacy. To be more specific, random session IDs provide a higher level of security compared to sequential IDs. Sequentially assigned session IDs are predictable and easier to guess or enumerate. Attackers could potentially guess or brute-force sequential session IDs, gaining unauthorized access to other users' sessions. Furthermore, sequential session IDs may inadvertently reveal information about the system's usage patterns, such as the number of active sessions or the rate at which sessions are created. This information can be useful for attackers in planning and executing attacks. -There are also some other reasons, such as the session ID length as sequential session IDs often have a limited and fixed length and increment by a predictable amount which can make it easier for attackers to perform session ID guessing attacks, while randome seesion IDs can have a larger range and a variable length. +*The first two reasons should be the security and privacy. To be more specific, random session IDs provide a higher level of security compared to sequential IDs. Sequentially assigned session IDs are predictable and easier to guess or enumerate. Attackers could potentially guess or brute-force sequential session IDs, gaining unauthorized access to other users' sessions. Furthermore, sequential session IDs may inadvertently reveal information about the system's usage patterns, such as the number of active sessions or the rate at which sessions are created. This information can be useful for attackers in planning and executing attacks. +There are also some other reasons, such as the session ID length as sequential session IDs often have a limited and fixed length and increment by a predictable amount which can make it easier for attackers to perform session ID guessing attacks, while randome seesion IDs can have a larger range and a variable length. * * Describe a way to attack a system which uses predictable session IDs. * Identify the pattern by observing the patterns of session IDs used in the target system.