We'll check the session tokens used in OWASP Mutillidae II to ensure they are created in a secure and an unpredictable way. An attacker who is able to predict and forge a weak session token can perform session fixation attacks.