I have been using GUIDs as un-guessable tokens in various situations for some time. I came across this question/answer which seems to suggest that while this is ok in some situations, it should not be done where security is a significant concern.

Typically when I am trying to understand a vulnerability, I will create an application on my test environment which reproduces the vulnerability and I can then exploit it to see how it works in the real world.

Can anyone point me to any resources that go over how a GUID that is being used as an un-guessable token could be guessed in a controlled environment?

  • This depends on how your application generates GUIDs, doesn't it? As one of the answers in the referenced question states, they were initially conceived to be unique, not unpredictable. So if you use e.g. last 3 MAC bytes XOR first 3 MAC bytes concatenated with your current system time in millisecs, it can easily be predicted. Jul 10, 2014 at 16:55
  • Lets say it's using .NET's built in GUID structure, which I believe uses Version 4? Jul 10, 2014 at 18:26
  • This may be relevant. stackoverflow.com/questions/643445/… Jul 10, 2014 at 18:39


You must log in to answer this question.

Browse other questions tagged .