Ever wondered how random a random generated session ID really is ? Because a lot of web applications rely on the session id for all the authentication and authorization , knowing the strength of the algorithm behind the session ID generation is essential. Michal Zalewski released a new tool precisely for this purpose : Stompy – the session stomper . Get it here : http://lcamtuf.coredump.cx/stompy.tgz