Re: http TRACE option

Hi !

If i understand it right cookies are sometimes protected with httpOnly
attribute from access with javascript on the web page (see below)

HttpOnly - If this attribute is set, then the cookie cannot be directly
accessed via client-side JavaScript, although not all browsers support
this restriction.

So in order to get cookies you need to use the TRACE method because it send
all your info back and only using this request can you get cookies with
javascript (in XSS attack for example).

P.S. Sorry for my English, it's not my native language.


On Thursday 17 January 2008 23:40, pentestr wrote:
Hi,
what is the issue if TRACE option is enabled in web servers ? Nessus
results always display it as warning.
any idea...

Thanks in advance.
Rgds.
P.T.

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • HACKING WITH JAVASCRIPT
    ... This tutorial is an overview of how javascript can be used to bypass ... You probably already know about sql injection, my goal is to explain how ... search forms, dynamic links, or session cookies. ... (select boxes, hidden fields, checkboxes and radio buttons, and cookies!). ...
    (comp.lang.java)
  • Re: Jargons of Info Tech industry
    ... >> Does the language allow Javascript to open a new window? ... >> in the HTML, it's a bug. ... >> If it can look at or set cookies stored on my system, ...
    (comp.unix.programmer)
  • Re: HACKING WITH JAVASCRIPT
    ... that javascript validation has allways been useless because its a client-side ... and 2 also hold for cookies, they are just an HTTP header and can easily be ... AFAIK SQL Injection has nothing to do with javascript ... > through search forms, dynamic links, or session cookies. ...
    (Bugtraq)
  • Re: Need help regarding redesigning website
    ... I experimented with JavaScript; but I found it was far more bother than it was worth. ... And I wouldn't know how to store userpreferences without cookies. ... I think you are on the VERY safe side avoiding all those techniques, but that also makes boring pages with a 1995 look and feel. ... Erwin Moller ...
    (comp.infosystems.www.authoring.html)
  • HACKING WITH JAVASCRIPT
    ... This tutorial is an overview of how javascript can be used to bypass ... SQL INJECTIONS ... through search forms, dynamic links, or session cookies. ...
    (Bugtraq)