Summar,
On Wed, May 5, 2010 at 3:48 AM, Summer nguyen <summer0ngu...@gmail.com> wrote:
> Dear Experts,
> I've finish my job writting Session Fixation Audit plugin.
Excellent!
> Can you test the plugin and give me comments about it.. I'll fix it
> immidiately.
> The plugin is attached.
These are my comments about the plugin:
- I would rename the file to "session_fixation.py"
- The file header says "xss.py" and it should say "session_fixation.py"
- I think it's possible to test for session fixation without having a
valid username and password combination. Please read the emails about
session fixation detection in this same mailing list.
- Debugging comments like "print "KAKAKAKAKAK"" should be removed :)
- getLongDesc returns all the information about XSS
- I'm not sure why you do this:
res2string=str(response.getHeaders()) ## convert to String
if 'Set-Cookie' in res2string: ## There is Cookie param
instead of doing this:
if 'Set-Cookie' in response.getHeaders():
response.getHeaders()['Set-Cookie']
- I don't understand the objective of "getJSESSION".
To sum up, I think that you have good intentions, but need to
review the main technique used to detect session fixation before
starting to code the plugin.
> Thank you very much.. I hope I can contribute much to W3af Community..
You did :)
Something that I would like to have is one or more PHP scripts
which are vulnerable to session fixation, and a w3af script (check for
examples in the scripts directory) in order to be able to test the
plugin. Could you do that? Thanks!
Regards,
>
> --
> Best Regards,
> Summer Nguyen .
>
> ------------------------------------------------------------------------------
>
> _______________________________________________
> W3af-develop mailing list
> W3af-develop@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/w3af-develop
>
>
--
Andrés Riancho
Founder, Bonsai - Information Security
http://www.bonsai-sec.com/
http://w3af.sf.net/
------------------------------------------------------------------------------
_______________________________________________
W3af-develop mailing list
W3af-develop@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/w3af-develop
