Session randomness analysis with Burp Suite sequencer

Dawid Czagan
January 24, 2014 by
Dawid Czagan

Users of web applications are identified by session IDs. An attacker can impersonate users when generated sessions are predictable. This article introduces Burp Suite Sequencer and shows how it can be used to analyze session randomness.

FREE role-guided training plans

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Burp suite sequencer

The sequencer is part of Burp Suite, which is an integrated platform for web site security testing [1]. Burp Suite Sequencer is helpful when analyzing session randomness.

Let's describe how to perform this analysis. The penetration tester intercepts the request (with Burp Suite Proxy) for which the response includes the session ID. Then the request is sent to Burp Suite Sequencer. After that, the penetration tester needs to choose the field in the response for which randomness will be analyzed (session ID in this example). Burp Suite Sequencer is launched. At least 100 requests need to be sent so that Burp Suite Sequencer can perform the analysis.


DVWA (Damn Vulnerable Web Application) is a web application that is intentionally vulnerable [2]. It is helpful for those who want to play with web application security stuff. DVWA is part of Metasploitable.

Metasploitable is a Linux-based virtual machine that is intentionally vulnerable [3]. It can be used, for example, to practice penetration testing skills. Please remember that this machine is vulnerable and should not operate in bridge mode.

This article shows how to analyze the randomness of session IDs generated by DVWA.

Request interception

When the penetration tester visits DVWA for the first time, the following request is sent (intercepted with Burp Suite Proxy).

Let's analyze the response to this request.

As we can see, the cookie with PHPSESSID is set. Now the penetration tester is going to send the request many times and analyze the values of PHPSESSID in the responses. There is no need to do it manually. It can be done automatically with Burp Suite Sequencer.

Sending request to Burp suite sequencer

Right-click right on the intercepted request with Burp Suite Proxy and choose "Send to Sequencer."

Launching Burp suite sequencer

The penetration tester wants to check the randomness of PHPSESSID in the response. That's why he needs to choose it in "Token Location Within Response." Then click "Start live capture" to launch Burp Suite Sequencer.

Burp suite sequencer—Analyzing randomness of PHPSESSID

When this tool has been launched, requests are sent and values of PHPSESSID are analyzed in the responses. The analysis can start after 100 requests ("Analyze now" button).

As we can see, the section "Overall result" shows information about the randomness of PHPSESSID within the sample of 189 requests. One can save the values of PHPSESSID to a file ("Save tokens" button; the result is shown below).


The attacker can impersonate a user when generated sessions are predictable. This article introduced Burp Suite Sequencer and showed how to use this tool to analyze session randomness. Another application of Burp Suite Sequencer could be, for example, randomness analysis of the CSRF token.

What should you learn next?

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.


Dawid Czagan
Dawid Czagan

Dawid Czagan (@dawidczagan) has found security vulnerabilities in Google, Yahoo, Mozilla, Microsoft, Twitter, BlackBerry and other companies. Due to the severity of many bugs, he received numerous awards for his findings.

Dawid is founder and CEO at Silesia Security Lab, which delivers specialized security auditing services with a results-driven approach. He also works as Security Architect at Future Processing.

Dawid shares his bug hunting experience in his workshop entitled "Hacking web applications - case studies of award-winning bugs in Google, Yahoo, Mozilla and more". To find out about the latest in Dawid's work, you are invited to visit his blog (https://silesiasecuritylab.com/blog) and follow him on Twitter (@dawidczagan).