Full Disclosure: Re: Microsoft Outlook Web Access Session sidejacking/Session Replay Vulnerability

[Darren McDonald <athena () dmcdonald net>]

I think you'll find that it was my point as well :) Sidejacking isnt a
vulnerability. It's the end result after an actual vulnerability has
been exploited. I.e. crappy session management, not setting the secure
flag, poor use of HTTPS, SSLv2/cipher reuse+weak ciphers+crap browser,
or whatever moronic thing the developer did to allow the session token
to go over the network in the clear in the first place.

Apparently sarcasm is a lost art form.

Renski

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/