Authentication and authorization are a key element of securing modern web/mobile applications, and most applications use a session token or some other type of token-based credential for such assertions. As a penetration tester, it can sometimes be very obvious when this process is broken, just by looking at the token value. But what if the token appears to be long enough, looks "random", and generally passes the smell test? Should we move on to other low-hanging fruit, or are there ways that we can dig deeper and still find vulnerabilities if we know the correct magic incantations?In this session, we will present a methodology for analyzing token-based authentication systems from a (mostly) black-box perspective. We will cover how to break down token values and categorize them, how to identify potential vulnerabilities for further testing, and when to execute practical attacks against obfuscated, pseudorandom, or cryptographic token values. We will also release some proof-of-concept tools for performing analysis, and reference prior talks/tools that cover some specific attacks. Hopefully, you will leave this session with some new techniques for your application testing process. If you're tired of using burp sequencer and wondering if you're wasting your time, this session might be of interest to you.