Re: Can you exploit this XSS?

["Sverre H. Huseby" <shh () thathost com>]

[Dawes, Rogan]

|   I get your cookie, you log in on the next step, and the cookie
|   does not change (for *MANY* applications). Now I have your cookie,
|   and it is for an authenticated session.
                                    v
For much more on this, see Mitja Kolsek's nice paper kalled "Session
Fixation Vulnerability in Web-based Applications" at

    http://www.acros.si/papers/session_fixation.pdf


Sverre.

-- 
shh () thathost com
http://shh.thathost.com/