so this is will be considered as vulnerability or not ? because Successful exploits may allow attackers to hijack web sessions or bypass authentication through a replay attack and gain access to a victim's email account.
Asheesh On Wed, Oct 26, 2011 at 5:55 AM, Darren McDonald <[email protected]>wrote: > I think you'll find that it was my point as well :) Sidejacking isnt a > vulnerability. It's the end result after an actual vulnerability has > been exploited. I.e. crappy session management, not setting the secure > flag, poor use of HTTPS, SSLv2/cipher reuse+weak ciphers+crap browser, > or whatever moronic thing the developer did to allow the session token > to go over the network in the clear in the first place. > > Apparently sarcasm is a lost art form. > > Renski >
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
