Re: Can you exploit this XSS?

From: Sverre H. Huseby (shh_at_thathost.com)
Date: 11/21/03

  • Next message: Parity: "RE: Can you exploit this XSS?" 
    Date: Fri, 21 Nov 2003 21:04:25 +0100
To: "Dawes, Rogan (ZA - Johannesburg)" <rdawes@deloitte.co.za>

    [Dawes, Rogan]

    | I get your cookie, you log in on the next step, and the cookie
    | does not change (for *MANY* applications). Now I have your cookie,
    | and it is for an authenticated session.
                                        v
    For much more on this, see Mitja Kolsek's nice paper kalled "Session
    Fixation Vulnerability in Web-based Applications" at

        http://www.acros.si/papers/session_fixation.pdf

    Sverre. 

    -- 
shh@thathost.com
http://shh.thathost.com/
  • Next message: Parity: "RE: Can you exploit this XSS?"

    Relevant Pages

    • RE: FormsAuthentication ReturnUrl - need it to be Absolute
      ... which are using forms authentication to protect the application. ... you're trying to make the applications share the same forms authentication ... the forms authentication cookie across multiple applications, ... If the forms authentication cross site support doesn't suit your scenario. ...
      (microsoft.public.dotnet.framework.aspnet)
    • RE: FormsAuthentication ReturnUrl - need it to be Absolute
      ... I understand you have multiple ASP.NET applications ... which are using forms authentication to protect the application. ... the forms authentication cookie across multiple applications, ... If the forms authentication cross site support doesn't suit your scenario. ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: Forms Authentication Name property
      ... number of web applications within it that all use the same authentication ... Then folks can login once for all the applications. ... use a forms authentication cookie named "mysite". ... The BROWSER chooses ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • Re: using a shared session
      ... you will have to pass the ticket to site. ... they will be prompted for a login. ... | We have 3 different web applications on three different websites (and ... | and is saved in the cookie for that session. ...
      (microsoft.public.dotnet.framework.aspnet)
    • Share authcookie between different applications on the same domain?
      ... Is it possible to share the authentication cookie of forms authentication ... between different applications on the same domain? ... A user must login on the login site and then I create the authentication ...
      (microsoft.public.dotnet.framework.aspnet.security)