SVIG/python-bootcamp
7
0
Fork 1
Code Issues Pull Requests 1 Releases Wiki Activity

Update page 'OWASP test questions_Karen'

Karenzz
2023-05-25 19:24:20 +02:00
parent 12715caec8
commit a6511242c6
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
OWASP test questions_Karen.md
+2 -2
@@ -55,8 +55,8 @@ https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
​ ​
* Why is it important that session IDs be random, instead of sequentially assigned? * Why is it important that session IDs be random, instead of sequentially assigned?
*The first two reasons should be the security and privacy. To be more specific, random session IDs provide a higher level of security compared to sequential IDs. Sequentially assigned session IDs are predictable and easier to guess or enumerate. Attackers could potentially guess or brute-force sequential session IDs, gaining unauthorized access to other users' sessions. Furthermore, sequential session IDs may inadvertently reveal information about the system's usage patterns, such as the number of active sessions or the rate at which sessions are created. This information can be useful for attackers in planning and executing attacks. *The first two reasons should be the security and privacy. To be more specific, random session IDs provide a higher level of security compared to sequential IDs. Sequentially assigned session IDs are predictable and easier to guess or enumerate. Attackers could potentially guess or brute-force sequential session IDs, gaining unauthorized access to other users' sessions. Furthermore, sequential session IDs may inadvertently reveal information about the system's usage patterns, such as the number of active sessions or the rate at which sessions are created. This information can be useful for attackers in planning and executing attacks.*
There are also some other reasons, such as the session ID length as sequential session IDs often have a limited and fixed length and increment by a predictable amount which can make it easier for attackers to perform session ID guessing attacks, while randome seesion IDs can have a larger range and a variable length. * *There are also some other reasons, such as the session ID length as sequential session IDs often have a limited and fixed length and increment by a predictable amount which can make it easier for attackers to perform session ID guessing attacks, while randome seesion IDs can have a larger range and a variable length.*
* Describe a way to attack a system which uses predictable session IDs. * Describe a way to attack a system which uses predictable session IDs.
* Identify the pattern by observing the patterns of session IDs used in the target system. * Identify the pattern by observing the patterns of session IDs used in the target system.