We will start analyzing RailsGoat's session cookie. We could have used any PHPSESSID or JSESSIONID cookie, but we will take advantage of this one being a custom value to review additional concepts. Configure your browser to use Burp Suite as a proxy and follow the next steps:
- Log in to RailsGoat and look at the proxy's history for a response setting a session cookie. You should have the header Set-Cookie and should set a cookie called _railsgoat_session.
- In this case, this is a request to /railsgoat/session. Right-click on the URL, or on the body of the request or response, and select Send to Sequencer:
- Before continuing ...
