CyberCertPrepWeb App FundamentalsCookies & SessionsEASYFree question
A developer notices that session IDs in their application are sequential integers (session_id=10001, session_id=10002, etc.). What attack does this trivially enable?
- A.SQL injection via numeric session IDs
- B.Replay attacks using the numeric session IDs
- C.CSRF because the session ID is predictable
- D.Session prediction / brute-force: an attacker who has any valid session ID (e.g., their own) can enumerate adjacent session IDs to hijack other users' sessions without needing to crack anything - sequential IDs have zero entropy relative to guessing
Why D is correct
Sequential session IDs have no randomness: if attacker knows their session ID is 10001, they know other active users likely have IDs around 10000-10050. They can iterate through IDs, making requests with each, until they hit another user's session. Session IDs must be cryptographically random with at least 128 bits of entropy to make guessing computationally infeasible. Never use sequential numbers, usernames, or any predictable values as session identifiers.
Know someone studying for Web App Fundamentals? Send them this one.