-
Notifications
You must be signed in to change notification settings - Fork 0
/
index.html
143 lines (122 loc) · 6.31 KB
/
index.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Session ID Guessing Simulator</title>
<link rel="stylesheet" href="styles.css">
<script src="humanize-duration.js"></script>
<script src="main.js"></script>
</head>
<body>
<h1>Session ID Guessing Simulator</h1>
<p>Welcome to the Session ID Guessing Simulator! This tool simulates how an attacker might attempt to guess session
IDs of users on a web application. You can adjust various parameters to see how the number of guesses and time
required change under different conditions.</p>
<!-- Input section for B, S, and A -->
<h2>Configure Simulation Parameters</h2>
<div class="section-box">
<label for="bits">Number of Bits (B) - Defines Entropy:</label>
<input type="number" id="bits" value="4" min="1">
<p class="input-explanation">The number of bits (B) defines how many possible session IDs exist (2^B). More bits
make guessing harder.</p>
<p>The total number of possible session IDs is: <code id="totalIds">16</code></p>
<br />
<label for="sessions">Number of Active Sessions (S) - Represents Concurrent Users:</label>
<input type="number" id="sessions" value="2" min="1">
<p class="input-explanation">This represents how many valid session IDs are currently in use. The attacker’s goal is
to guess one of these.</p>
<br />
<label for="requests">Requests per second (A) - Attacker's Speed <em>(optional)</em>:</label>
<input type="number" id="requests" placeholder="Leave blank if unknown" min="1" max="100000000">
<p class="input-explanation">If provided, we will estimate how long it might take to guess a valid session ID.</p>
</div>
<!-- Session ID selection method -->
<h2>Select Session ID Method</h2>
<div class="section-box">
<p><strong>Session ID selection method:</strong></p>
<input type="radio" id="dynamicSessions" name="sessionMethod" value="dynamic" checked>
<label for="dynamicSessions">Dynamic session IDs (valid IDs change on every guess)</label>
<details>
<summary>More about Dynamic Sessions</summary>
<p>With dynamic session IDs, the valid session IDs change after every guess. This simulates users logging in and
out frequently.</p>
</details>
<input type="radio" id="staticSessions" name="sessionMethod" value="static">
<label for="staticSessions">Static session IDs (valid IDs do not change throughout the attack)</label>
<details>
<summary>More about Static Sessions</summary>
<p>With static session IDs, the valid session IDs do not change. This simulates long-lasting session IDs, like API
keys.</p>
</details>
</div>
<!-- Guessing strategy -->
<h2>Select Guessing Strategy</h2>
<div class="section-box">
<p><strong>Guessing strategy:</strong></p>
<input type="radio" id="randomGuesses" name="guessStrategy" value="random" checked>
<label for="randomGuesses">Random guessing</label>
<p class="input-explanation" id="randomExplanation">Each guess is chosen randomly. In static mode, random guessing
may repeat and be less efficient.</p>
<input type="radio" id="incrementalGuesses" name="guessStrategy" value="increment">
<label for="incrementalGuesses">Incremental guessing</label>
<p class="input-explanation" id="incrementExplanation">Incremental guessing avoids repeat guesses in static mode and
improves efficiency.</p>
<input type="radio" id="decrementalGuesses" name="guessStrategy" value="decrement">
<label for="decrementalGuesses">Decremental guessing</label>
<p class="input-explanation" id="decrementExplanation">Decremental guessing also avoids repeats in static mode,
making it more efficient.</p>
</div>
<!-- Formulas and Expected Guesses Section -->
<!-- Formulas and Expected Guesses Section -->
<div id="formulaSection">
<h3>Expected Guesses/Duration:</h3>
<div class="formula-container">
<div class="formula-row">
<strong>Values: </strong>
<span>B = </span><span id="BValue" class="formula-value"></span>,
<span>S = </span><span id="SValue" class="formula-value"></span>,
<span>A = </span><span id="AValue" class="formula-value"></span>
</div>
<div class="formula-row">
<strong>Expected Guesses Formula: </strong>
<span id="expectedGuessesFormula" class="formula"></span>
</div>
<div class="formula-row">
<strong>Expected Guesses: </strong>
<span id="expectedGuesses" class="expected-result">- guesses</span>
</div>
<div class="formula-row" id="expectedDurationFormulaLine" style="display: none;">
<strong>Expected Duration Formula: </strong>
<span id="expectedDurationFormula" class="formula"></span>
</div>
<div class="formula-row" id="expectedDurationLine" style="display: none;">
<strong>Expected Duration: </strong>
<span id="expectedDuration" class="expected-result">-</span>
</div>
</div>
</div>
<!-- Simulation section -->
<div id="simulationSection">
<h3>Run Simulation:</h3>
<p id="bitLimitError" style="display: none; color: red;">Error: Number of bits (B) must be less than or equal to 32 for the simulation.</p>
<label for="trials">Number of trials (recommend 10000):</label>
<input type="number" id="trials" value="10000" min="1000">
<p class="input-explanation">More trials give more accurate results but take longer.</p>
<button id="runSimulation">Run Simulation</button>
<div id="progressBar">
<div id="progressBarFill"></div>
</div>
<p><strong>Progress:</strong> <span id="progress">0%</span></p>
<div id="results">
<h3>Simulation Results:</h3>
<p><strong>Average guesses until first success:</strong> <span id="avgGuesses">-</span></p>
<p><strong>What this means:</strong> With the current setup, an attacker would need to make <span
id="avgGuessesMeaning">-</span> guesses on average to guess a valid session ID.</p>
<div id="timeResults">
<p><strong>Average duration until first success:</strong> <span id="simTime">-</span></p>
</div>
</div>
</div>
</body>
</html>