“Guessing that the string may actually be a hex encoding of a string of ASCII characters, you can run it through a decoder to reveal the following: user = daf; app = admin; date = 10/ 09/ 11 Attackers can exploit the meaning within this session token to attempt to guess the current sessions of other application users.”