|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
Re: Jetty Session ID Prediction
From: Michal Zalewski (lcamtuf
dione.ids.pl)
Date: Tue Feb 06 2007 - 12:10:49 CST
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
On Tue, 6 Feb 2007, Chris Anley wrote:
> http://www.ngssoftware.com/research/papers/Randomness.pdf
Nice paper, and quite certainly helpful for security testers as far as
showing the weakness of standard library PRNGs to others goes.
> The idea is eventually to have a tool that performs point-and-click
> identification, analysis and prediction of an unknown source of
> "randomness", including LCGs but also more advanced generators such as
> the Mersenne twister and SHA1PRNG.
Now not that I want to be obtrusive than I already am (hi mom!), but
http://lcamtuf.coredump.cx/stompy.tgz can very well tell LCGs from
SHA1PRNGs - that and do a bunch of other tricks ;-)
/mz
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]