Top 10 winner

Bruteforce of PHPSESSID

Arseny Reutov, Timur Yunusov and Dmitry Nagibin · blog.ptsecurity.com · 22 August 2012

Positive Technologies turn Argyros and Kiayias's PHP randomness research into a working attack on PHPSESSID. The session id is an MD5 of client IP, timestamp, microseconds and php_combined_lcg output, and two tricks cut the search space: adversarial time synchronisation pins the server clock from the Date header, and request twins minimise the gap between two requests.

Record

Researcher

Arseny Reutov, Timur Yunusov and Dmitry Nagibin

Published by

blog.ptsecurity.com

Date

22 August 2012

In the archive

• Ranked #4 in the 2012 Top 10 Web Hacking Techniques

Related sources

• Research scripts and tables

Tags

• php
• auth-bypass
• info-leak
• tooling
• timing-attack
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Arseny Reutov, Timur Yunusov and Dmitry Nagibin, first published at the original source. Preserved copies are kept so the citation survives its host.