the-web-application-hackers-handbook

Chapter 7 n Attacking Session Management 221
of bits of effective entropy within the token; this the key result to consider.
However, you can also drill down into the results of each test to understand
exactly how and why different parts of the token passed or failed each test, as
shown in Figure 7-3. The methodology used for each type of test is described
beneath the test results.
Figure 7-3: Analyzing the Burp Sequencer results to understand the properties of
the tokens that were tested
Note that Burp performs all tests individually on each character and bit of data
within the token. In many cases, you will find that large parts of a structured
token are not random; this in itself may not present any kind of weakness. What
matters is that the token contains a sufficient number of bits that do pass the
randomness tests. For example, if a large token contains 1,000 bits of information,
and only 50 of these bits pass the randomness tests, the token as a whole
is no less robust than a 50-bit token that fully passes the tests.