Posted by Rosario Valotta on May 24
Hi,
last week, in two security conferences I showed a new attack technique
called Cookiejacking that allows to steal session cookies without any XSS
vulnerability.
https://www.swisscyberstorm.com/speakers/valotta
http://conference.hackinthebox.org/hitbsecconf2011ams/?page_id=1388
All previous approaches on the same topic used at least an XSS or a Man in
the middle attack (eg Firesheep) to steal cookies.
In this approach I use a 0-day…
Source: Cookiejacking attack technique
