View source for Talk:Testing for Bypassing Authentication Schema (OTG-AUTHN-004)

Can't seem to delete sections 4. It is redundant. Also, there is a mispelling of the word Authentication in the image.

== Direct page request image ==

Is it possible to replace the image below Direct Page Request with one that is more intuitive? I'm not exactly sure what the intent of that image was.

== Why is it possible to restrict brute force when cookie id goes symmetrically? ==

In Session ID Prediction, document says that "In the following figure, values inside cookies change only partially, so it's possible to restrict a brute force attack to the defined fields shown below." whereas, Session ID goes very symmetrically in some part, so it is possible to guess what a sequenced valid cookie is.
First part of the Session ID increases 1 by 1; second part of the Session id increases almost 10 by 10.
Am I right?