Re: New Web Vulnerability - Cross-Site Tracing (fwd)

[Gary Flynn <flynngn () jmu edu>]

Jeremiah Grossman wrote:
>
> The essential pieces that
> are require for full exploitation as I define is... script on a page,
> domain-restriction-bypass flaw (not essential), and a trace supporting
> target.

So the essential pieces that require "full exploitation as you
define" are:

1. script on a page
2. a trace supporting web target

and nothing else?

I was confused by your lead-in of "essential" and the inclusion
of "domain-restriction-bypass flaw" with a "not essential"
disclaimer.

thanks,
--
Gary Flynn
Security Engineer - Technical Services
James Madison University

Please R.U.N.S.A.F.E.
http://www.jmu.edu/computing/runsafe