1

I have a REST api in which the server allots a unique token each time a user is logged in. Its a hash containing numbers,letters and a one or two special chars. I want to check the entropy of these tokens. If it were session-ids I could have used webscarab's session id analyzer. But since the api response is in json I can't use webscarab.

Is there any methods to check the entropy of the parameter. I can collect all such values(100s or 1000s) to a file, but what I lack is a method for entropy analysis. Does soapui has such a functionality? Are there any secure methods to do this?

Improve this question
1
  • If you have enough entropy you can bring back to bits you can check the randomness using either FBI or German BSI randomness validators. But I guess that would "somewhat" of an overkill. It would require a study into randomness just to interpret in the input requirements & the output.
    – Maarten Bodewes
    Jun 19, 2015 at 8:24

1 Answer 1

Reset to default
3

Where I've encountered this issue in the past, the best approach I've seen is to script something up in your favorite programming language of choice (e.g. Ruby/Python/Powershell) to retrieve instances of the tokens and then write them to a file. Once you've got a suitable sample, you can load them up into your entropy analysis tool of choice.

Another option would be to use Burp Suite and its sequencer tool, which allows you to specify a custom location in the HTTP response for the token to be captured from. (more information here)

Improve this answer
2
  • I can script them into a file, but the problem is lack of tool for the process of analysis. Anyway thanks a lot for the Burp Suite suggestion. I didn't know that custom location in HTTP can be set using Burp :)
    – Anonymous Platypus
    Jun 19, 2015 at 8:12
  • cool. if you script them to a file you can load that into burp as well, so that's another option...
    – Rory McCune
    Jun 19, 2015 at 11:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .