Re: IIS session cookies

["Kevin Spett" <kspett () spidynamics com>]

What do you mean by "IIS session cookies"?  Do you mean the ASPSESSIONID
feature? And what do you mean by formed?  Are you talking about the PRNG
behind it, or how a developer can use them?


Kevin Spett
SPI Labs
http://www.spidynamics.com/

----- Original Message -----
From: "Cade Cairns" <cairnsc () securityfocus com>
To: <webappsec () securityfocus com>
Sent: Thursday, December 05, 2002 5:29 PM
Subject: IIS session cookies


> Hello webappsec,
>
> I'm looking for information on how IIS session cookies are formed (that
> is, what data they consist of or how they are encoded, etc.)  Is anyone
> aware of any papers or resources on the subject?
>
> Thanks,
>
> Cade Cairns
> Symantec Corporation