Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Web-App-Sec
[Top] [All Lists]

RE: Cross Site Cooking

Subject: RE: Cross Site Cooking
Date: Sun, 29 Jan 2006 17:56:30 +0000 (GMT)
    Problem #1 - trouble with these pesky foreigners
    ------------------------------------------------

    Both MSIE and Firefox seem to be perfectly happy with two-period
    ccTLDs domain cookies (.xxx.xx).

    In other words, one can set a cookie for *.com.pl or *.com.fr, and
    override or corrupt credentials or other parameters on hundreds of
    thousands e-commerce websites in that country. It will be also
    possible to plant attacker's session ID on visitor's computer,
    and effectively, steal his credentials when he decides to sign in
    on the target site.

I'm afraid this doesn't work for me.
 
I tried setting a cookie for .com.pl, and
I failed (that is, the browser did not respect
it). If you set a cookie for .kom.pl, it will be OK
(if you're in .kom.pl domain, that is).

The browsers (at least
IE 6.0) seem to be smarter, and use a more fine
grained strategy, e.g. something like:
http://spamassassin.apache.org/full/3.0.x/dist/lib/Mail/SpamAssassin/Util/
RegistrarBoundaries.pm

<Prev in Thread] Current Thread [Next in Thread>