I'm testing a Web application based on SAP for a customer. One of the checks we normally do is to analyse the cookie holding the session token to make sure that it is sufficiently random and you can't predict the next valid token. We do this using Burp sequencer.
On this occasion I noticed that the cookie appeared to have a large amount of static data at the beginning of it. I Base64 decoded it and found out that the first 130 characters (in text) contain the user name, customer code and date/time. I believe this is a known 'feature' of SAP.
What I am struggling to be able to explain in my report is how the results of the decoder match up to the sequencer. For example - in clear text in the cookie the static data should start at position zero and finish at character 130 - but this does not correspond to the values seen in the character analysis in the sequencer - nor does the number of characters shown in total correspond to the actual character count in the cookie. I can see the static portion in the sequencer, and even the entropy spike where the time portion changes, I just can't correlate the character positions. In addition, when I look at the bit analysis in the sequencer, the values seem to be reversed, so that instead of seeing the static value at the start of the sequence - I can see it at the end.
I hope someone can explain to me what I am seeing and many thanks for any help.