“Whenever we log into an application, the server issues a session ID. We hear that the session ID we get is unique, but what if we could guess the next unique session ID which the server will generate?”
The interesting session-management bugs are rarely a stolen token. They are a token you did not have to steal because the next one was predictable — a counter with a timestamp stirred in, a home-grown “random” string seeded from the process ID. If the server generates identifiers you can forecast, authentication stops being a wall and becomes arithmetic. Burp Suite for Pentester: Sequencer is about proving that mathematically rather than asserting it.
The Mathematics of Exploitation
Sequencer exists to answer one question: how much genuine randomness is in this token? The guide works through both character-level and bit-level analysis over a large captured sample, and — usefully — keeps the statistics honest. It walks through capturing live sequences from a deliberately vulnerable app such as bWAPP, piping the traffic into Sequencer, and forcing the server to mint thousands of tokens for analysis.
The caveat the tool itself will tell you, and the guide reinforces: entropy estimates are only as trustworthy as your sample size. A confident-looking result on a few hundred tokens is not proof of anything, and a small sample that reports “excellent” randomness is the most common way testers talk themselves out of a real finding.
Targeting Custom Variables
Standard PHPSESSID cookies are the easy case. Real applications bury anti-forgery values in odd places, and the strongest part of this text is its coverage of custom token locations.
It shows how to override Sequencer’s automatic detection with explicit start and end delimiters, or a regular expression, to isolate a CSRF token, a password-reset hash, or a non-standard API key out of the response body for analysis. That control is what lets you test the token the developer thought nobody would look at.
Who Is This Book REALLY For?
- Application Cryptographers & AppSec Engineers: Sequencer gives you the evidence to tell a development team their bespoke token generator is broken — a graph beats an assertion in that argument every time.
- Web Penetration Testers: When injection paths are exhausted, testing the predictability of the session logic itself is the fallback that still finds critical bugs.
- Bug Hunters: Weak session identifiers and predictable CSRF tokens are consistently high-severity. This is the method for proving predictability rather than merely suspecting it.
The Bottom Line
Burp Suite for Pentester: Sequencer turns an abstract cryptographic weakness into a demonstrable one. Its lasting point is simple: “custom” random-number generation is almost always weaker than its author believes — and here is how to measure exactly how weak.
