On Dec 12, 2007 6:21 PM, Fredrick Diggle <[EMAIL PROTECTED]> wrote: > What no one seems to realize is that XSS by its very nature is not a > vulnerability. It is a perfectly valid mechanism to aid in exploitation but > can anyone cite me an example where xss in and of itself accomplishes > anything? I can think of pretty much 3 examples of XSS (granted without > giving it much thought because lets face it it isn't worth much thought) > > 1. you are taking something from a user which is accessible from the > scripting language context of their browser. > In this case the vulnerability is not XSS the vulnerability is either that > you (or the web browser) are storing something valuable in an insecure way. > The most obvious example of this is something like session cookies which if > your auth/session management is implemented in a secure way won't matter a > bit. It follows that the vulnerability is not XSS but instead that some > developer stored something valuable in a stupid way. All of the retards on > the list will no doubt ask me for a secure session management schema but I > am a firm believer that sharing is communism so screw you. >
Sorry, but i can't see how having access to session cookies is unimportant. Even if nothing valuable is stored by the session management, there is one key factor: session cookies will grant you access to a user's session, unless other checks are in place (like the user's IP address). Take for example gmail - login, copy it's cookies to another browser and then access it from that browser - how is gmail's session management flawed? _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
