hhucn / webvulnscan

automated web application vulnerability scanner
MIT License
38 stars 27 forks source link

Write a attack module which checks session-lengths and tokens #27

Open rliebig opened 11 years ago

rliebig commented 11 years ago

It would be intresting, to do this because it is commonly handled by the various frameworks and not the "real" application. However it should be detected to do this. It is possible to determine the exact time, using a equation, avaible here. I think 100 for A is a reasonable amount of possible requests and we can assume that there is one user for S. B should be calculateable.

Intresting Links:

The length of the session expiration should be also checked.