Home page logo

webappsec logo WebApp Sec mailing list archives

Re: [WEB SECURITY] Round-up: Ways to bypass HttpOnly (and HTTP Basic auth)
From: Pilon Mntry <pilonmntry () yahoo com>
Date: Wed, 3 May 2006 06:35:19 -0700 (PDT)

I liked the generalization in the 3rd category because
that test script might also be a service or an action
or an event that regenerates the session id without
any extra challenge. (as i tried to express in another


It looks like the attacks fall into three

- attacks requiring XSS + TRACE.
- attacks requiring XSS + request smuggling.
- attacks requiring XSS + a test script that acts
similarly to the
TRACE method, returning request values to the

Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 

Sponsored by: Watchfire

The Twelve Most Common Application-level Hack Attacks
Hackers continue to add billions to the cost of doing business online 
despite security executives' efforts to prevent malicious attacks. This 
whitepaper identifies the most common methods of attacks that we have seen, 
and outlines a guideline for developing secure web applications. 
Download this whitepaper today!


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]