Say I talk to a developer who is using some output of a Pseudo-random number generator in order to do some security task. I know based upon common knowledge that only Cryptographically Secure Pseudo Random Numbers should be used.
However, I want to take this a step further - how would I create a proof-of-concept that the current method is not secure? I would guess that I need a large collection of outputs from this particular PRNG algorithm... But aside from that, I have no idea what else I would need to do. Is there a way for me to use a cryptanalysis tool to derive the seed or salt (assuming there is one)? How can I prove or disprove that such a PRNG is predictable using security auditing tools and/or scripts? Assume the same seed is used.