SessionID analysis tools/methods?

[lister () lihim org]

In Webscarab, I notice that the entire item is compared as a whole,
how do I break the JSESSION into pieces, or determine which of the
entire string is random (ie. if the JSESSION uses 0000 at the beginning
how do I find out which parts of the entire string are static, or not
as random?

I've seen some people use the SESSIONID to store information about the app
(ie. append, pre-pend information with the randomness somewhere in-between)

I'd be interested in any other tools (gui or non-gui) to analyse randomness
of SessionIDs.

On a more theoretical level, what mathematical/statistical tests should be
conducted against the data.

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Security Trends Report from Cenzic
Stay Ahead of the Hacker Curve!
Get the latest Q2 2008 Trends Report now

www.cenzic.com/landing/trends-report
------------------------------------------------------------------------