Collected research
Cookie Path Traversal
An encoded backslash in the request path, as in /en/us/test/..%5Cdefault.aspx, is a directory delimiter to IIS but not to the browser, so a cookie scoped to a path it should never reach gets sent anyway. Works in the then-current IE, Firefox, Opera and Safari. Useful mainly for lifting httpOnly cookies when header disclosure exists at one path and the cookie belongs to another.
Record
- Researcher
- kuza55
- Published by
- kuza55.blogspot.com
- Topic
- Identity
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of kuza55, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .