Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Web-App-Sec
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: Cross Site Cooking

from [Michal Zalewski] Network Security [Permanent Link]
Subject: Re: Cross Site Cooking
Date: Wed, 1 Feb 2006 11:30:09 +0100 (CET) 
On Tue, 31 Jan 2006, Aman Raheja wrote:


Both IE and Firefox have the capability to disallow the websites to set
cookies for third party domains.


This is a wholly different function; it prevents portions of content that
are hosted elsewhere than the site / domain you're currently viewing (say,
provided by ad companies) from dropping you a cookie.

In other words, when you go to flybynight.com, and they have a banner that
needs to be fetched from pillsandpr0n.biz, Set-Cookie headers returned by
pillsandpr0n.biz will be ignored, thus making it harder for them to track
you as you browse the web.

This does not stop bork.xyzzy.example.com from setting a cookie for
frob.knob.example.com when you view that first website.

Cheers,
/mz

-------------------------------------------------------------------------
This List Sponsored by: Watchfire

Watchfire's AppScan is the industry's first and leading web application 
security testing suite, and the only solution to provide comprehensive 
remediation tasks at every level of the application. See for yourself. 
Download AppScan 6.0 today.

https://www.watchfire.com/securearea/appscansix.aspx?id=701300000003Ssh
--------------------------------------------------------------------------
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • Re: Cross Site Cooking, Michal Zalewski <=
Previous by Date:  Black Hat USA CFP opens, Europe early bird reminder, Federal news, Jeff Moss
Next by Date:  Fwd: SF new article announcement - Malicious Malware: attacking the attackers, part 2, Andrew van der Stock
Previous by Thread:  Black Hat USA CFP opens, Europe early bird reminder, Federal news, Jeff Moss
Next by Thread:  Fwd: SF new article announcement - Malicious Malware: attacking the attackers, part 2, Andrew van der Stock
Indexes:  [Date] [Thread] [Top] [All Lists]