Collected research
Exploiting XSS vulnerabilities on cookies
Exploits an XSS that only reflects a cookie value, where nothing the browser normally sends would carry the attacker's cookie. A Flash movie's LoadVars.addRequestHeader sets a Cookie header on a cross-domain POST, planting the script payload; demonstrated against pics.defcon.org. Works on the then-current Flash Player, but not in Internet Explorer.
Record
- Researcher
- sirdarckcat
- Published by
- sirdarckcat.blogspot.com
- Topic
- XSS
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of sirdarckcat, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .