[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-disclosure] Microsoft Outlook Web Access Session sidejacking/Session Replay Vulnerability
- To: William Reyor <opticfiber@xxxxxxxxx>
- Subject: Re: [Full-disclosure] Microsoft Outlook Web Access Session sidejacking/Session Replay Vulnerability
- From: Darren McDonald <athena@xxxxxxxxxxxxx>
- Date: Wed, 26 Oct 2011 01:25:48 +0100
I think you'll find that it was my point as well :) Sidejacking isnt a
vulnerability. It's the end result after an actual vulnerability has
been exploited. I.e. crappy session management, not setting the secure
flag, poor use of HTTPS, SSLv2/cipher reuse+weak ciphers+crap browser,
or whatever moronic thing the developer did to allow the session token
to go over the network in the clear in the first place.
Apparently sarcasm is a lost art form.
Renski
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/