Re: [Full-disclosure] stompy the session stomper - tool availability

Michal Zalewski wrote:
Hi all,

I'd like to announce the availability of 'stompy', a free tool to perform
a fairly detailed black-box assessment of WWW session identifier
generation algorithms. Session IDs are commonly used to track
authenticated users, and as such, whenever they're predictable or simply
vulnerable to brute-force attacks, we do have a problem.


[snip]
Yet, while there are several nice GUI-based tools designed to analyze HTTP
cookies for common problems (Daves' WebScarab, SPI Cookie Cruncher,

Just wanted to point out that Dave has had nothing to do with WebScarab
(and that I recognise that WebScarab's analysis is pretty trivial).
Would you have any objection to me including/porting Stompy's analysis
portion into WebScarab, to make it more accessible to folk?

Regards,

Rogan Dawes
WebScarab author

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/