1

I have been using GUIDs as un-guessable tokens in various situations for some time. I came across this question/answer which seems to suggest that while this is ok in some situations, it should not be done where security is a significant concern.

Typically when I am trying to understand a vulnerability, I will create an application on my test environment which reproduces the vulnerability and I can then exploit it to see how it works in the real world.

Can anyone point me to any resources that go over how a GUID that is being used as an un-guessable token could be guessed in a controlled environment?

Improve this question
3
  • This depends on how your application generates GUIDs, doesn't it? As one of the answers in the referenced question states, they were initially conceived to be unique, not unpredictable. So if you use e.g. last 3 MAC bytes XOR first 3 MAC bytes concatenated with your current system time in millisecs, it can easily be predicted.
    – Dmitry Janushkevich
    Jul 10, 2014 at 16:55
  • Lets say it's using .NET's built in GUID structure, which I believe uses Version 4?
    – Abe Miessler
    Jul 10, 2014 at 18:26
  • This may be relevant. stackoverflow.com/questions/643445/…
    – Andrew Hoffman
    Jul 10, 2014 at 18:39

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .