Re: [WEB SECURITY] Round-up: Ways to bypass HttpOnly (and HTTP Basic auth)

["Amit Klein (AKsecurity)" <aksecurity@xxxxxxxxxx>]

On 3 May 2006 at 8:29, Brian Eaton wrote:

> 
> It looks like the attacks fall into three categories:
> 
> - attacks requiring XSS + TRACE.
> - attacks requiring XSS + request smuggling.
> - attacks requiring XSS + a test script that acts similarly to the
> TRACE method, returning request values to the browser.
> 
> Am I reading that properly?
> 

And then there are:

- attacks requiring XSS + virtual hosting on same machine with a malicious virtual site
- attacks requiring XSS + proxy server on the way


---------------------------------------------------------------------
The Web Security Mailing List
http://www.webappsec.org/lists/websecurity/

The Web Security Mailing List Archives
http://www.webappsec.org/lists/websecurity/archive/