I have a REST api in which the server allots a unique token each time a user is logged in. Its a hash containing numbers,letters and a one or two special chars. I want to check the entropy of these tokens. If it were session-ids I could have used webscarab's session id analyzer. But since the api response is in json I can't use webscarab.
Is there any methods to check the entropy of the parameter. I can collect all such values(100s or 1000s) to a file, but what I lack is a method for entropy analysis. Does soapui has such a functionality? Are there any secure methods to do this?