IP Spoofing??
From: pire pire (pirepire69_at_romandie.com)
Date: 12/02/03
- Previous message: Zachary Mutrux: "fire suppression"
- Next in thread: Gavin Zuchlinski: "Re: IP Spoofing??"
- Reply: Gavin Zuchlinski: "Re: IP Spoofing??"
- Reply: Adam Newhard: "Re: IP Spoofing??"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 2 Dec 2003 23:02:07 +0100 To: security-basics@securityfocus.com
Hi,
I've found a vulnerability in a Web App which
gave me via an XSS the sessionID token.
I would like to replay this token. But the
session ID manager (on the server) seems to look
also to IP adresses.
So my question is: Is there a way to spoof my ip
address in order to replay the sessionID??
Like:
http://www.tutu.com/toto.php?sessionid=32443243
and some how spoof of my IP?!
If I replay the sessionid from my machine or an
other machine behind my NAT (same outside IP) it
works!!
Thanks a lot for your help
_______________________________________________
La messagerie gratuite des romands : 10 MO !!!
Profitez-en ! >>> http://www.romandie.com
---------------------------------------------------------------------------
----------------------------------------------------------------------------
- Previous message: Zachary Mutrux: "fire suppression"
- Next in thread: Gavin Zuchlinski: "Re: IP Spoofing??"
- Reply: Gavin Zuchlinski: "Re: IP Spoofing??"
- Reply: Adam Newhard: "Re: IP Spoofing??"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
