Thanks for the ideas, guys. I'm running into a bit of technical trouble, though. Perhaps you could shed some light? I now have a "victim" web server set up that I can test XSS on, and I have also set up an "attacker" web server that basically sits there and eats cookies via CGI, storing them to a local directory. The next question may seem very rudimentary, but can you just write those to your user's "cookie" folder and "hijack" their session to the web site? I know I'm missing something ::scratching my head:: -Jeremy ---------------------------------------------------------------------------- This list is provided by the SecurityFocus Security Intelligence Alert (SIA) Service. For more information on SecurityFocus' SIA service which automatically alerts you to the latest security vulnerabilities please see: https://alerts.securityfocus.com/
This archive was generated by hypermail 2b30 : Wed Jan 08 2003 - 14:42:04 PST