Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have run a penetration test on a web server. To generate session IDs with curl. I have generated session IDs like so :

#! /bin/bash
NUMBEROFSESSIONS=3000
for i in $(seq 1 ${NUMBEROFSESSIONS})
do
curl -s -c cookie 'URL' 1> /dev/null # URL is the address of my server
cat cookie | grep HttpOnly >> sessionIDs.lst
done

When this test is run on a linux machine, the session ID are not repeated. but on MAC, I got some repeated IDs.
Does anyone know why ?

To check for repeated IDs I do : wc -l sessionIDs.lst; cat sessionIDs.lst | uniq |wc -l

share|improve this question
    
Is the Mac the client or the server or both? Also, how is the server generating the session IDs? –  Ladadadada Oct 29 '13 at 18:28
    
The mac is the client running the pentesting script on. The server is win server 2K8 R2 with apache tomcat 7. In the code source the session id cannot be repeated. The script is run several times on linux machines and there is no repeated session ID. –  user2933032 Nov 1 '13 at 2:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.