On Dec 11, 2007 12:28 PM, Porco Graxa <[EMAIL PROTECTED]> wrote: > ... Ask the google for "Gmail logout CSRF" or "Google > logout csrf" and approximately 9 billion query results come > immediately.
lolz; csrf has as many moves as web 2.0 has slutty ports (listening on :80) csrf with static get hrefs alone not wow'ing us ... persistent xss with csrf for session hijacking (that's a tasty cookie you got there, boy) a bit more fun ... multi-platform / persistent session hijacking via external plugins / handlers for vulnerable mime types has potential (particularly when target is connected to a proxy that would otherwise filter such attempts)... how many more variations? i'm seeing stars in the sky... _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
