Chapter 9 / 12

Grade token randomness

A predictable session cookie, CSRF token, or reset code is one an attacker can forge or guess. The Sequencer collects a few hundred of them and grades the real unpredictability each one carries. This playbook runs one grade end to end (point, collect, read, export) in about ten minutes, most of it spent waiting on the server to hand out samples.

Before you begin. Set up an engagement so the target is scoped; the Sequencer replays a live request many times and won't fire out of scope. Have a flow whose response sets the token you want to grade (a Set-Cookie for a session or CSRF token). Only collect tokens from a target you're authorized to test; each sample is a real, freshly minted credential.

1. Point the Sequencer at a token

The Sequencer tab is off the bar by default. It's a workbench you reach for occasionally, not part of the daily loop β€” press 0 and type "seq", or Ctrl-P β†’ Go to Sequencer.

Feed it from a captured flow: in History, select the flow whose response sets the token, then Space β†’ Send to Sequencer. gori auto-detects the likely session cookie and drops you on the CONFIG pane. Press c to reconfigure the token location if the guess is wrong: pick one of Cookie, Header, Regex, Position, or JSONPath.

Aim the extraction at the token's varying region only. Real tokens carry a skeleton (a sess_v1_ prefix, a version byte, padding) that never changes across the sample. Counting that fixed structure as if it were random drags the grade down and can misfire the bit-level tests, so the token descriptor should cover the part that actually moves.

gori Send to Sequencer config card over the History tab, showing an auto-detected session cookie as the token, with rows for sample count, max requests, concurrency and notification
Sending a captured flow to the Sequencer auto-detects the session cookie and lets you set the sample size and concurrency before collecting.

Checkpoint. The CONFIG pane names your source flow and the token location you picked; the SAMPLES pane is still empty.

2. Collect samples

Press Ctrl-R to collect. gori replays the source request over and over, pulling the token out of each response, until it reaches the target count. Ctrl-X stops early. Collection runs at concurrency 1 by default, because session tokens are often stateful (each request advances a server-side counter), and firing them in parallel would scramble the order the tests rely on. Raise it only when the endpoint is stateless.

Same collection, headless: replay flow 42, extract the SESSIONID cookie, gather 500 tokens:

gori run sequence 42 --cookie SESSIONID --count 500

Checkpoint. The SAMPLES count climbs toward your target as the replays land.

3. Read the grade

The ANALYSIS pane leads with effective entropy in bits (a conservative estimate of the real unpredictability per token) and a rating that follows from it: Secure (β‰₯ 88 bits), Moderate (β‰₯ 60), Weak (β‰₯ 30), Critical (below 30). Under it sits the battery of statistical tests gori ran over the token bitstream (monobit, runs, chi-square, serial correlation, compression, and more).

Read it like this: a high entropy figure with every row passing means the token looks random to every test gori has; no shortcut to forge it turned up. Any duplicate or sequential token, though, drops the verdict straight to Critical however high the entropy reads, because a token you saw twice is a token you can predict. A small sample (under ~20 usable tokens) softens hard failures to warnings and caps the rating, so collect more before you trust a clean grade.

Checkpoint. The ANALYSIS pane shows one overall rating plus the per-test table behind it.

4. Export the verdict

The collected tokens are live credentials, so gori never writes them to disk; they vanish with the session. The verdict shouldn't. Press ⇧E to export a Markdown report to a path you choose (the palette offers the same report as JSON), or Space β†’ i to file it as an Issue, which maps Critical to critical, Weak to high, Moderate to medium, and Secure to info. Neither carries a token value: the report is built from frequency tables and verdicts, so there's nothing in it to leak.

Checkpoint. You have a saved grade, report or Issue, and not a single raw token left behind.

Next Steps