"The tester can use a tool such as WebScarab to perform session ID analysis." . . . .