A developer notices that session IDs in their application are sequential integers (session_id=10001, session_id=10002, etc.). What attack does this trivially enable?

• A.Session prediction / brute-force: an attacker who has any valid session ID (e.g., their own) can enumerate adjacent session IDs to hijack other users' sessions without needing to crack anything - sequential IDs have zero entropy relative to guessing
• B.Session fixation: the attacker sets the next integer for the victim's session ID (session_id=10003), then waits for the victim to log in with it, taking over the account without any password guessing, a step that regenerating the ID at login would block
• C.Cross-site request forgery: a predictable counter (10001, 10002) lets a forged form guess the next valid anti-CSRF value from the page source, sending state-changing requests on behalf of the victim from another origin domain, a forgery that works against any form on the site
• D.Denial of service: sequential IDs let an attacker allocate session records at a fixed rate (one new ID per request), exhausting the server's memory in minutes, a flood that rate limits on the login form stop for good in most setups, with each record holding about 1KB of data