Getting started with Burp Sequencer - Port Swigger
Summary: PortSwigger's tutorial walks through using Burp Sequencer to analyze the quality of randomness in an application's session tokens, with results shown in the Live capture window as a summary of randomness quality in the sample. PortSwigger warns that Sequencer may produce unexpected results in some applications and advises using it only against non-production systems until the user is fully familiar with its functionality and settings.
What's compelling: Session tokens are the thing standing between an attacker and an authenticated session, and this tool exists because weak randomness in those tokens is testable - but PortSwigger's own caution about unexpected results means pointing it at production is a risk in itself.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026