WebApp Sec: Re: Cross Site Cooking

[Aman Raheja <araheja () techquotes com>]

Both IE and Firefox have the capability to disallow the websites to set 
cookies for third party domains.
Amit Klein (AKsecurity) wrote:

>    Problem #1 - trouble with these pesky foreigners
>    ------------------------------------------------
>
>    Both MSIE and Firefox seem to be perfectly happy with two-period
>    ccTLDs domain cookies (.xxx.xx).
>
>    In other words, one can set a cookie for *.com.pl or *.com.fr, and
>    override or corrupt credentials or other parameters on hundreds of
>    thousands e-commerce websites in that country. It will be also
>    possible to plant attacker's session ID on visitor's computer,
>    and effectively, steal his credentials when he decides to sign in
>    on the target site.
>
> I'm afraid this doesn't work for me.
>
> I tried setting a cookie for .com.pl, and
> I failed (that is, the browser did not respect
> it). If you set a cookie for .kom.pl, it will be OK
> (if you're in .kom.pl domain, that is).
>
> The browsers (at least
> IE 6.0) seem to be smarter, and use a more fine
> grained strategy, e.g. something like:
> http://spamassassin.apache.org/full/3.0.x/dist/lib/Mail/SpamAssassin/Util/
> RegistrarBoundaries.pm
>
>  

--

---------------------------------------------
Aman Raheja
Security+, Linux+ Certified.
http://www.techquotes.com
PGP Key http://www.techquotes.com/araheja.asc
---------------------------------------------



-------------------------------------------------------------------------
This List Sponsored by: Watchfire

Watchfire's AppScan is the industry's first and leading web application 
security testing suite, and the only solution to provide comprehensive 
remediation tasks at every level of the application. See for yourself. 
Download AppScan 6.0 today.
https://www.watchfire.com/securearea/appscansix.aspx?id=701300000003Ssh
--------------------------------------------------------------------------