SessionId Prediction - Classic ASP - Tool?

Have read several articles on classic .asp that its possible to predict session id. Has anyone had any practical experience with this or know of a tool that can assist with this?

From an article,

"The session ID is a read-only value that uniquely identifies the current clients to the Web server. In classic ASP, session IDs are assigned in a sequential manner?the session ID 706616433 is followed by the session ID 706616434, and so on. The classic ASP session ID is stored on the client?s machine in the form of an encrypted nonpersistent cookie. For example, the session ID 706616434 would be stored on the client machine as the cookie ASPSESSIONIDGQQGQGCS=JHMBOBKCBINEHLPKJHOPABBE." - Edmond Woychowsky

How is it known that 706616434 equates to ASPSESSIONIDGQQGQGCS=JHMBOBKCBINEHLPKJHOPABBE?

Any advice or tool suggestions would be appreciated.

Jay


------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • Re: How do u set classic ASP session variables from an ASP.NET application???
    ... "How to Share Session State Between Classic ASP and ASP.NET" ... > public class ASPSession ... > public String this ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: session sharing from ASP to ASP.NET
    ... ASP and ASP.NET do not share session data. ... their code within the context of the Classic ASP "Engine". ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: ASP sessionstate
    ... ASP doesn't know or care what browser it ... If html is already sent ... What is a session number? ... Session initialisation is done by the server system, ...
    (microsoft.public.inetserver.asp.general)
  • session_start problems among other things?
    ... The third party has a shopping cart which must be saved in the ... the hosted server that we do not see on our internal development ... save and restore the cart to the session so as to concentrate the ... ASP.NET APIs could be called from ASP pages but the development was ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: IIS 6 loses ASP sessions
    ... ASP bug with keeping track of session IDs -- hard to imagine since it'd ... include crashes happening in the worker process (different process identity ... unless we run IIS 6.0 in 5.0 Isolation Mode. ...
    (microsoft.public.inetserver.iis)