To elaborate on this, I'm looking at this from the perspective of a hacker/penetration tester. Many times I have seen web applications that I know have weak cookies. I can tell this because I can issue hundreds/thousands of login requests and the session cookies that the server responds with will have noticeable patterns in them. For example, some session cookies will have repeated characters present in all session cookies(e.g., the first 6 characters of a 13 character session cookie are all the same). Others are generated based on time, so if I issue a bunch of login requests all at the same time, the server will respond with the same session cookie (Assuming the server generates the cookie based on the second/minute).
While these types of patterns are easily noticeable, I know that some patterns aren't so easy for us humans to see.
So my two questions:
1) What methods and tools are out there to determine the strength of a cookie?
2) Once a weak session cookie has been identified, how would one go about analyzing and reverse engineering the session cookie generation algorithm? (Keeping in mind that the end goal here is to eventually be able to predict session cookies)