WebApp Sec mailing list archives
Re: Cross Site Cooking
From: Aman Raheja <araheja () techquotes com>
Date: Tue, 31 Jan 2006 08:12:19 -0600
Both IE and Firefox have the capability to disallow the websites to set cookies for third party domains.
Amit Klein (AKsecurity) wrote:
Problem #1 - trouble with these pesky foreigners ------------------------------------------------ Both MSIE and Firefox seem to be perfectly happy with two-period ccTLDs domain cookies (.xxx.xx). In other words, one can set a cookie for *.com.pl or *.com.fr, and override or corrupt credentials or other parameters on hundreds of thousands e-commerce websites in that country. It will be also possible to plant attacker's session ID on visitor's computer, and effectively, steal his credentials when he decides to sign in on the target site. I'm afraid this doesn't work for me. I tried setting a cookie for .com.pl, and I failed (that is, the browser did not respect it). If you set a cookie for .kom.pl, it will be OK (if you're in .kom.pl domain, that is). The browsers (at least IE 6.0) seem to be smarter, and use a more fine grained strategy, e.g. something like: http://spamassassin.apache.org/full/3.0.x/dist/lib/Mail/SpamAssassin/Util/ RegistrarBoundaries.pm
-- --------------------------------------------- Aman Raheja Security+, Linux+ Certified. http://www.techquotes.com PGP Key http://www.techquotes.com/araheja.asc --------------------------------------------- ------------------------------------------------------------------------- This List Sponsored by: WatchfireWatchfire's AppScan is the industry's first and leading web application security testing suite, and the only solution to provide comprehensive remediation tasks at every level of the application. See for yourself. Download AppScan 6.0 today.
https://www.watchfire.com/securearea/appscansix.aspx?id=701300000003Ssh --------------------------------------------------------------------------
Current thread:
- Cross Site Cooking Michal Zalewski (Jan 28)
- <Possible follow-ups>
- RE: Cross Site Cooking Amit Klein (AKsecurity) (Jan 29)
- RE: Cross Site Cooking Michal Zalewski (Jan 30)
- Re: Cross Site Cooking Aman Raheja (Jan 31)
- Re: Cross Site Cooking Michal Zalewski (Feb 02)
- Re: Cross Site Cooking john-secfocus (Jan 31)
- Re: Cross Site Cooking Erwan Legrand (Jan 31)
- Re: Cross Site Cooking Michal Zalewski (Jan 31)
- RE: Cross Site Cooking Evans, Arian (Jan 31)