In this tutorial, you will learn how to test weak session IDs in DVWA (Damn Vulnerable Web Application) using a practical web application security testing approach. We will examine how session IDs are generated at DVWA’s Low, Medium, and High security levels and analyze whether the values are predictable or sufficiently random.
This practical exercise is useful for understanding session management testing, session ID predictability, and the security risks associated with weak session identifiers.
Lab environment: This tutorial assumes DVWA is installed locally using XAMPP on a Windows machine. Perform these tests only on systems you own or are authorized to test.
Access DVWA
Open the DVWA login page: http://localhost/DVWA/login.php
Log in using the default DVWA credentials:
- Username: admin
- Password: password
After logging in, click DVWA Security from the left-side menu.
Select Low from the security-level dropdown and click Submit.
Test Weak Session IDs at Low Level
From the left menu, click Weak Session IDs.
The page can also be accessed locally at: http://localhost/DVWA/vulnerabilities/weak_id/
Open Firefox Developer Tools by pressing F12.
Go to: Storage → Cookies → http://localhost
Click the Generate button on the DVWA page.
For the first request, the cookie may be: dvwaSession = 1
Click Generate again: dvwaSession = 2
Click it once more: dvwaSession = 3
Analysis
The session ID is clearly predictable:
1 → 2 → 3 → 4 → 5 ...The value is extremely simple and changes sequentially. An attacker who discovers this pattern may be able to predict subsequent session identifiers.
This demonstrates why session IDs should not be generated using simple sequential values.
You can click the View Source button on the page to inspect the underlying code and understand how the selected security level is implemented.
Security Impact
Predictable session IDs can contribute to attacks such as:
- Session hijacking
- Session impersonation
- Session fixation in vulnerable application designs
- Unauthorized access to another user’s session
Test Weak Session IDs at Medium Level
Now return to DVWA Security. Change the security level to: Medium
Click Submit and return to Weak Session IDs.
Click Generate several times and record the dvwaSession values.
The values are longer than the Low-level values, but simply increasing the length does not necessarily make a session ID secure.
Analyze the Session ID
Compare the generated values:
1789534287
1789537052
1789537063You can observe that the values resemble Unix/Epoch timestamps.
For example, a timestamp conversion tool can be used to investigate whether the values correspond to specific dates and times.
The supplied examples correspond to:
1789534287 → Wednesday, 16 September 2026 at 10:21:27
1789537052 → Wednesday, 16 September 2026 at 11:07:32
1789537063 → Wednesday, 16 September 2026 at 11:07:43Analysis
The important finding is not simply that the cookie is longer. The problem is that the value is derived from a predictable source such as time.
If a session identifier can be derived from a timestamp or another predictable value, an attacker may be able to narrow down or predict possible session IDs.
Therefore:
Longer does not automatically mean stronger.
A secure session ID needs sufficient randomness and unpredictability.
Test Weak Session IDs at High Level
Now go to: DVWA Security → High
Select High and click Submit.
Return to Weak Session IDs and click Generate several times.
You may observe values such as:
c4ca4238a0b923820dcc509a6f75849b
c81e728d9d4c2f636f067f89cc14862c
eccbc87e4b5ce2fe28308fd9f2a7baf3
These values look much more complex than the Low and Medium examples.
However, complexity of appearance does not necessarily mean that the session ID is unpredictable.
Analyze the High-Level Values
The values shown above correspond to MD5 hashes of simple sequential values:
c4ca4238a0b923820dcc509a6f75849b → 1
c81e728d9d4c2f636f067f89cc14862c → 2
eccbc87e4b5ce2fe28308fd9f2a7baf3 → 3
You can investigate MD5 values using a hash lookup/decryption service such as: MD5 Decrypt
Analysis
Although the session ID now appears to be a long hexadecimal string, the underlying input is still predictable:
1 → MD5 → c4ca4238a0b923820dcc509a6f75849b
2 → MD5 → c81e728d9d4c2f636f067f89cc14862c
3 → MD5 → eccbc87e4b5ce2fe28308fd9f2a7baf3Hashing a predictable value does not make the underlying session-generation process unpredictable.
This is an important lesson when testing session management:
A complex-looking session ID can still be weak if its generation mechanism is predictable.
The three levels demonstrate an important security concept: encoding or hashing a predictable value does not automatically create a secure session identifier.
What to Check During Real-World Testing
When testing session management in an authorized application, look for:
- Sequential session IDs
- Timestamp-based session IDs
- Predictable numeric patterns
- Static prefixes or suffixes
- Repeating values
- Insufficient randomness
- Session IDs derived from usernames or other predictable information
- Reuse of previously invalidated session IDs
- Weak session regeneration after authentication
- Insufficient session expiration and invalidation
For deeper analysis, testers can collect multiple session IDs and analyze their randomness and predictability using appropriate testing tools, including Burp Suite Sequencer.
Conclusion
DVWA provides a simple way to understand how weak session identifiers can be identified.
At Low, the session ID is directly sequential. At Medium, the value demonstrates a predictable timestamp-based pattern. At High, the value looks much stronger because it is represented as an MD5 hash, but the underlying input remains predictable.
The key lesson is that session IDs must be generated using strong, unpredictable randomness. Simply increasing the length or hashing a predictable value does not provide adequate protection against session-related attacks.
For secure session-management implementation guidance, refer to the OWASP Session Management Cheat Sheet.
