Typical severity: High. Likelihood of attack: High. This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
Use a strong source of randomness to generate a session ID. | Use adequate length session IDs | Do not use information available to the user in order to generate session ID (e.g., time). | Ideas for creating random numbers are offered by Eastlake [RFC1750] | Encrypt the session ID if you expose it to the user. For instance session ID can be stored in a cookie in encrypted format.