SESSION TOKENS

Session tokens are unique identifiers a web application uses to identify a user. it is tied to the user's session. attackers who obtain a valid session token can impersonate the user to the web application, thus taking over their session. brute-forcing valid session tokens is similar to brute-forcing valid password-reset tokens. this can occur when session tokens doesn't provide sufficient randomness (insufficient entropy) or is cryptographically weak. it is crucial to capture multiple session tokens and analyze them to ensure that session tokens provide sufficient randomness to disallow brute-force attacks against them.

• Set-Cookie: session=a5fd (uncommon in the real-world)

• Set-Cookie: session=2c0c58b27c71a2ec5bf2b4b6e892b9f9 (common)