I have been looking at OWASP and other forms of checklists on testing web applications. One of the best practices is to ensure session IDs generated are sufficiently random and unpredictable.
Assuming that I am a corporate end user without having permissions to install software on my laptop, to test the security of a web application from my web browser.
From my understanding, if we were to have a web app that always enforce an encrypted HTTPS (SSL/TLS) connection to prevent the disclosure of the session ID through MitM (Man-in-the-Middle) attacks, this ensures that anyone cannot simply capture the session ID from web browser traffic.
If the session IDs are indeed encrypted due to HTTPS, are we still able to determine if the session IDs are sufficiently random and unpredictable? I was asking myself this question and for me, a close and probable answer I would give myself, is no. (I might be wrong)
Am I also right to say, to know that if session IDs are generated randomly and unpredictably, you would actually need to have access to the internal web application code? There are probably a lot more that I can't do without additional tools to gather more information on the web application.
What are the other kind of test cases - as an end user, who might not have advanced tools to sniff the network or to read underlying code, to test more comprehensively and value-add on my test cases on the web applications? For e.g. testing for invalid input and seeing if errors are thrown.