All websites that support authenticated user interactions have a password recovery feature. Usually they will email the password reset link through which you can easily recover your account by typing a new password. So, when pentesting some of these websites I've noticed that the password recovery token seems to be somewhat guessable. Some of the websites use MD5 or Base64 encoding for their password recovery tokens.
So, my question is whether is there are any standard procedures we could use to determine the strength of a token, or the method through which token has been generated?
Example of password recovery link:
http://example.com/users/password?recover_token=qQGgQrwzzz1SV1X9xznc
(Where the password Recovery token is qQGgQrwzzz1SV1X9xznc)