How would I test that a website I'm successfully authenticated on (currently in session) has set my session ID in a safe way and isn't vulnerable?
I believe a session ID should be obscured at the very least (rather than referencing an auto-incremented id, for example), so I'd like to check this. Other than that, I'd like to look at how the session ID is set (I think - is this of relevance?). And also, how can interrogate the session ID? I've fired up dev tools and had a look in the cookie request header, but it doesn't appear to be in there.