the-web-application-hackers-handbook

220 Chapter 7 n Attacking Session Management
configure various options that affect how tokens are collected, and then click
the start capture button to begin capturing tokens. If you have already obtained
a suitable sample of tokens through other means (for example, by saving the
results of a Burp Intruder attack), you can use the manual load tab to skip the
capturing of tokens and proceed straight to the statistical analysis.
Figure 7-2: Configuring Burp Sequencer to test the randomness of a session token
When you have obtained a suitable sample of tokens, you can perform the
statistical analysis on the sample. You can also perform interim analyses while
the sample is still being captured. In general, obtaining a larger sample improves
the reliability of the analysis. The minimum sample size that Burp requires is
100 tokens, but ideally you should obtain a much larger sample than this. If the
analysis of a few hundred tokens shows conclusively that the tokens fail the
randomness tests, you may reasonably decide that it is unnecessary to capture
further tokens. Otherwise, you should continue capturing tokens and re-perform
the analysis periodically. If you capture 5,000 tokens that are shown to pass the
randomness tests, you may decide that this is sufficient. However, to achieve
compliance with the formal FIPS tests for randomness, you need to obtain a
sample of 20,000 tokens. This is the largest sample size that Burp supports.
Burp Sequencer performs the statistical tests at character level and bit level.
The results of all tests are aggregated to give an overall estimate of the number