Finding Ticketbleed
Only thing it wonder is why would you 'test' for the bug with only 1 byte of memory leaked? False negatives would be a lot smaller if you reversed it and send a 1-byte session id and have 31 bytes to test.He says "By picking 31 bytes I ensured the sensitive information leakage would be negligible." but if you don't save/inspect other than verifying it's not 31x0, I don't see the problem?