Come back to our video lecture verbalisation sessions are often maintained by stationary tokens that
consist of random or pseudo random values because of this randomness is absolutely critical to the security
of these applications.
In this recipe we will see how to collect the generated values and test them for randomness using Buxar
sequencer but search sequence or performs a number of different mathematically elevations against a
simple of pseudo random numbers in an attempt to do to mine the sources of entropy from when they are
generated live capture can be used to generate sample values by showing crafted request that will result
in new Eliz being assigned.
This is often done by removing an existing Cookie's value from the request so that the response provides
a new session token in the form of a new set cookie response Hayder let's open a browser open suit and
intercept is on.
Let's refresh the page here you can see their proxy is captured the request from the browser.
Now I am going to send this request to reboot to find reichlich and send to the Peter Peter tool.
We have already learned in the patterns tab we can add or remove cookies post-date and the word.
Now I will remove all the cookies except security hit Go button to send the repeater.
Here you can see that in the response to get the response from the server if any response containing
these cookies had a value and others either random number value to be displayed so it needs to be sent
to sequester but will dramatically populate the cookie dropdown menu with all the cookie values set
in the response.
I assume that if you can use the custom location field and then the configurable can do designate any
location in the response for testing.
After defining the value to be tested click on this dot lab capture button.
This will start submitting a large number of requests to acquire additional values for the defined parameter
but will issue a large number of request with the BHB.
Yes society value stripped from the request.
This will cause the server to generate a new session token for each request.
By doing this we can acquire simple enough values that can be subjected to 5 to FIP as testing.
This will consist of a series of test that will evaluate the entropy associated with the generated pseudo
random numbers.
All of these tests can be presented in a graphical format that is easy to understand.
For a highly accurate and true Fabia stressed a total of 20000 values but an analysis can be performed
with as few as 100 values in addition to performing live capture.
The manual load that can be used to upload our best at list off Laddie's for testing that all of our
sequencer.
If we have confused with any tool please feel free to ask in the order ASAP.
Top10 will let him lecture us.
We will discuss how they are used in testing our backbone program.
Thank you.
See you in the next class.