Re: on xss and its technical merit

["Joao Inacio" <jcinacio () gmail com>]

On Dec 12, 2007 6:21 PM, Fredrick Diggle <fdiggle () gmail com> wrote:
> What no one seems to realize is that XSS by its very nature is not a
> vulnerability. It is a perfectly valid mechanism to aid in exploitation but
> can anyone cite me an example where xss in and of itself accomplishes
> anything? I can think of pretty much 3 examples of XSS (granted without
> giving it much thought because lets face it it isn't worth much thought)
>
> 1. you are taking something from a user which is accessible from the
> scripting language context of their browser.
>   In this case the vulnerability is not XSS the vulnerability is either that
> you (or the web browser) are storing something valuable in an insecure way.
> The most obvious example of this is something like session cookies which if
> your auth/session management is implemented in a secure way won't matter a
> bit. It follows that the vulnerability is not XSS but instead that some
> developer stored something valuable in a stupid way. All of the retards on
> the list will no doubt ask me for a secure session management schema  but I
> am a firm believer that sharing  is communism so screw you.

Sorry, but i can't see how having access to session cookies is unimportant.
Even if nothing valuable is stored by the session management, there is
one key factor: session cookies will grant you access to a user's
session, unless other checks are in place (like the user's IP
address).
Take for example gmail - login, copy it's cookies to another browser
and then access it from that browser - how is gmail's session
management flawed?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/