Thanks, my bad on "Cookie Stealing". It does show "secret"
2011/6/6 ๏̯͡๏ Jasvir Nagra <[email protected]>: > Some of the attacks have been mitigated by changes made by browser makers. > Comments inline below. > > On Mon, Jun 6, 2011 at 3:20 AM, Bish <[email protected]> wrote: >> >> Folks - Demos on homepage do not seem to be consistent. >> >> Here is what works and doesn't for me: >> >> Redirection - Works: IE6, FF4, Chrome11 >> >> Sniffing User History - Doesn't Work: IE6, FF4, Chrome11 > > Browsers makers have adopted essentially the same fix that Caja does since > FF4, Chrome 11 and IE9. Filing a bug for IE6. >> >> Script Injection - Works: IE6, Doesn't Work: Chrome11, FF4 > > Support for script injection via setting innerHTML varies a lot between > browsers. Filing a bug to switch to innerHTML = '<img onload="">' which I > believe still causes script execution on all browsers. >> >> LAN Scanning - Works: IE6, Chrome 11, FF4 >> >> Cookie Stealing - Doesn't Work: IE6, Chrome 11, FF4 > > I am not sure what you mean when you say it doesn't work. In the uncajoled > case, the cookie should be undefined. In the cajoled case, the cookie ought > to be "secret". Is this not the case? >> >> Is it just me? >> >> Thanks, >> >> Bish > > -- Bish
