Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have run a penetration test on a web server. To generate session IDs with this Bash script :

#! /bin/bash
for i in $(seq 1 ${NUMBEROFSESSIONS})
curl -s -c cookie 'URL' 1> /dev/null # URL is the address of my server
cat cookie | grep HttpOnly >> sessionIDs.lst

When this test is run on a Linux machine, the session ID are not repeated, but on Mac I get some repeated IDs.

Does anyone know why?

To check for repeated IDs I do :

wc -l sessionIDs.lst; cat sessionIDs.lst | uniq |wc -l
share|improve this question
Is the Mac the client or the server or both? Also, how is the server generating the session IDs? – Ladadadada Oct 29 '13 at 18:28
The mac is the client running the pentesting script on. The server is win server 2K8 R2 with apache tomcat 7. In the code source the session id cannot be repeated. The script is run several times on linux machines and there is no repeated session ID. – user2933032 Nov 1 '13 at 2:24
Wouldn't this just be coincidence? Run curl in verbose mode (add -v to the command line) on both Linux and Mac and see if the requests differ. – André Borie Dec 14 '15 at 9:42
Are you using an explicit or transparent proxy between your client and server? – daniel Azuelos Dec 14 '15 at 10:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.