I have been using GUIDs as un-guessable tokens in various situations for some time. I came across this question/answer which seems to suggest that while this is ok in some situations, it should not be done where security is a significant concern.

Typically when I am trying to understand a vulnerability, I will create an application on my test environment which reproduces the vulnerability and I can then exploit it to see how it works in the real world.

Can anyone point me to any resources that go over how a GUID that is being used as an un-guessable token could be guessed in a controlled environment?

  • This depends on how your application generates GUIDs, doesn't it? As one of the answers in the referenced question states, they were initially conceived to be unique, not unpredictable. So if you use e.g. last 3 MAC bytes XOR first 3 MAC bytes concatenated with your current system time in millisecs, it can easily be predicted. Jul 10 '14 at 16:55
  • Lets say it's using .NET's built in GUID structure, which I believe uses Version 4? Jul 10 '14 at 18:26
  • This may be relevant. stackoverflow.com/questions/643445/… Jul 10 '14 at 18:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.