Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

I have run a penetration test on a web server. To generate session IDs with curl. I have generated session IDs like so :

#! /bin/bash
for i in $(seq 1 ${NUMBEROFSESSIONS})
curl -s -c cookie 'URL' 1> /dev/null # URL is the address of my server
cat cookie | grep HttpOnly >> sessionIDs.lst

When this test is run on a linux machine, the session ID are not repeated. but on MAC, I got some repeated IDs.
Does anyone know why ?

To check for repeated IDs I do : wc -l sessionIDs.lst; cat sessionIDs.lst | uniq |wc -l

share|improve this question
Is the Mac the client or the server or both? Also, how is the server generating the session IDs? –  Ladadadada Oct 29 '13 at 18:28
The mac is the client running the pentesting script on. The server is win server 2K8 R2 with apache tomcat 7. In the code source the session id cannot be repeated. The script is run several times on linux machines and there is no repeated session ID. –  user2933032 Nov 1 '13 at 2:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.