We have identified a session ID that seems to be predictable. Now let's try to find a valid session. To do this, you'll take the same request that receives the cookie and send it to Intruder. In this case, you just want to repeat the same request several times. However, Intruder needs to have insertion points for it to run, so add a header (Test: 1) to the request and set the insertion position in its value:
You will send 101 requests in this test, so set the payload to be of the Numbers type, with a sequential increase from 0 to 100:
Now go to the Options tab, and in the Grep-Extract section, add one item. Be sure ...
