I know that some of PHP's random functions are insecure due to them not being completely random and are considered a bad practice. My question is how an attacker go about finding that the developer used an insecure function to create a token, such as a forgotten password token or CSRF token?
You can't actually determine how random a number is, because it's the nature of randomness. However, if you had a series of values, you could perform statistical randomness tests on the values and possibly find patterns/weaknesses in the random number generator. Certain patterns may give away what random generator was used. But even supposing the numbers were random in a statistical sense, the problem that remains afterwards is security. Something that passes randomness tests may not actually be secure!
- true randomness = security
- statistical randomness ≠ true randomness
Further to Kevin Li's answer, testing your session IDs for randomness is covered here: How to test session identifier strength with OWASP WebScarab
You need to request loads of session tokens and perform a statistical analysis on them to determine if they appear to exhibit the desired level of randomness. 10^4 session IDs would be a good minimal starting point IMHO but it would be best to analyse more if you can.
There is also an automated tool in PortSwigger's Burp proxy to do the same thing which I use but burp is quite expensive.
(would comment on the other answer but I don't have the rep)