How to Crack a Website - XSS, Cookies, Sessions

twistedmoney45 writes "Informit.com provides an insiders look at a real life XSS attack and how it was used to bypass the authentication scheme of an online web application, leading to "shell" access, an admin account, and more. XSS attacks are often discussed in theory — this walk through illustrates just how dangerous these types of attacks can be in reality."

Comments

Interesting read, but...

[mdobossy]

Sure, it is an interesting read.. that being said, nothing here is exactly shocking.

I may be reading this wrong, but, he gains access to the server by requiring a legitimate user to log on to the site, through a third party server of his (Might be done via phishing, etc..), then he nabs a valid php session id, via some injected javascript code. Why not just grab the users login and password when they submit the form through your server? If you already have them logging in via a proxy, this would be much easier, and more reliable- sessions expire, etc..

As with most of these articles on security- simply make sure you sterilize any incoming data. Again, its not exactly rocket science.

Re:More Like a Phishing Attack

[Fallus Shempus]

So you're going to rely on user's intelligence?

You're not a coder are you.

Re:Some simple fixes would be sufficient

[FooBarWidget]

limit the session to the IP-address of the visiting user.

Is this really a good idea? I've heard stories from people on mailing lists who claim that many people are behind routers/proxies that cause IP changes very often, and that's restricting a session to an IP causes more problems than it's worth.