<?xml version="1.0" encoding="iso-8859-1" ?>
<rss version="2.0">
  <channel>
    <title>CSRF and Session Info</title>
    <link>http://sla.ckers.org/forum/list.php?4</link>
    <description><![CDATA[Q and A on cross site request forgeries and breaking into sessions.  It's one of the attacks that XSS enables and the attack of the future. For Session, fixations, hijacking, lockout, replay, session riding etc....]]></description>
    <language>EN</language>
    <pubDate>Mon, 01 Feb 2010 08:19:45 -0600</pubDate>
    <lastBuildDate>Mon, 01 Feb 2010 08:19:45 -0600</lastBuildDate>
    <category>CSRF and Session Info</category>
    <generator>sla.ckers.org web application security forum</generator>
    <ttl>600</ttl>
    <item>
      <title>Re: A potentially dangerous Request.QueryString value was detected</title>
      <link>http://sla.ckers.org/forum/read.php?4,23676,33240#msg-33240</link>
      <author>PaPPy</author>
      <description><![CDATA[ive come across a lot of sites with this.
but if the XSS is into a link or into javascript you can still exploit using quotes, onmouse events and other javascript if your in tags]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,23676,33240#msg-33240</guid>
      <pubDate>Mon, 01 Feb 2010 08:19:45 -0600</pubDate>
    </item>
    <item>
      <title>Re: Data encoding - crackable?</title>
      <link>http://sla.ckers.org/forum/read.php?4,32771,33231#msg-33231</link>
      <author>cykyc</author>
      <description><![CDATA[As you noted, you're getting collisions on the hash throughout your testing. I wonder if either the application is having threading issues or if the hash is based on something not fully related to &quot;in&quot; value. Try slowing down your requests a bit and see if you still get collisions.]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,32771,33231#msg-33231</guid>
      <pubDate>Sun, 31 Jan 2010 18:58:08 -0600</pubDate>
    </item>
    <item>
      <title>Re: Data encoding - crackable?</title>
      <link>http://sla.ckers.org/forum/read.php?4,32771,33213#msg-33213</link>
      <author>clayfox</author>
      <description><![CDATA[The 40 character string definitely screams SHA1. I think you were correct in thinking that the input is hashed with something else. That something else is often the IP address. Try hashing the in with the IP concatenated on the beginning or the end.]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,32771,33213#msg-33213</guid>
      <pubDate>Fri, 29 Jan 2010 09:09:58 -0600</pubDate>
    </item>
    <item>
      <title>Re: anti-CSRF token implemented only in the cookie</title>
      <link>http://sla.ckers.org/forum/read.php?4,33109,33212#msg-33212</link>
      <author>clayfox</author>
      <description><![CDATA[If the domain and path of the cookie are set at a high level of generality and you have multiple subdomains, then you don't just have to worry about XSS in the domain in question, but rather all subdomains since they will all have access to the cookie.]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,33109,33212#msg-33212</guid>
      <pubDate>Fri, 29 Jan 2010 08:16:56 -0600</pubDate>
    </item>
    <item>
      <title>Re: anti-CSRF token implemented only in the cookie</title>
      <link>http://sla.ckers.org/forum/read.php?4,33109,33139#msg-33139</link>
      <author>joel</author>
      <description><![CDATA[@PaPPy
If there is a xss, writing the token string directly into the form cannot defence csrf either.

http://blog.thinkphp.de/archives/150-Buy-one-XSS,-get-a-CSRF-for-free.html]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,33109,33139#msg-33139</guid>
      <pubDate>Thu, 21 Jan 2010 19:58:06 -0600</pubDate>
    </item>
    <item>
      <title>Re: anti-CSRF token implemented only in the cookie</title>
      <link>http://sla.ckers.org/forum/read.php?4,33109,33123#msg-33123</link>
      <author>PaPPy</author>
      <description><![CDATA[just hope you dont have xss on ur site...

not writing the string directly into the form(via js) is the same as writing it in the script

especially cause you can save the html and get the value, or use javascript to get the key]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,33109,33123#msg-33123</guid>
      <pubDate>Thu, 21 Jan 2010 07:53:33 -0600</pubDate>
    </item>
    <item>
      <title>Re: anti-CSRF token implemented only in the cookie</title>
      <link>http://sla.ckers.org/forum/read.php?4,33109,33118#msg-33118</link>
      <author>joel</author>
      <description><![CDATA[@Gareth Heyes, great idae :p

In my case, there is only one token in the cookie, just like:

vtoken=8a995a95c13fda450b0776532156fe07

but this token does not appear in the html form, the form look like:
...

...

I am considering this implemention robust to defense csrf?]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,33109,33118#msg-33118</guid>
      <pubDate>Wed, 20 Jan 2010 20:06:18 -0600</pubDate>
    </item>
    <item>
      <title>Re: anti-CSRF token implemented only in the cookie</title>
      <link>http://sla.ckers.org/forum/read.php?4,33109,33110#msg-33110</link>
      <author>Gareth Heyes</author>
      <description><![CDATA[I did this a while ago:-
http://www.thespanner.co.uk/2007/08/15/random-javascript-and-php-generation/

It works well most of the time. Obviously it's not a form of security as the keys are generated on the client but many spammers don't execute js in their tools. Some use browsers or have a parser but the majority don't.

I applied it to CSRF as well:-
http://www.thespanner.co.uk/2007/10/19/jsck/]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,33109,33110#msg-33110</guid>
      <pubDate>Wed, 20 Jan 2010 08:37:23 -0600</pubDate>
    </item>
    <item>
      <title>anti-CSRF token implemented only in the cookie</title>
      <link>http://sla.ckers.org/forum/read.php?4,33109,33109#msg-33109</link>
      <author>joel</author>
      <description><![CDATA[Hey, guys. I found that some web application implementing anti-CSRF token only in the cookie, but not in the html form.

When they post data, they use javascript to get the anti-CSRF token from the cookie, and check the token in the background application between the post data and cookie data.

How do you think about this implemention?]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,33109,33109#msg-33109</guid>
      <pubDate>Wed, 20 Jan 2010 07:40:29 -0600</pubDate>
    </item>
    <item>
      <title>Re: how i found a CSRF Bug ?</title>
      <link>http://sla.ckers.org/forum/read.php?4,33036,33093#msg-33093</link>
      <author>thornmaker</author>
      <description><![CDATA[http://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,33036,33093#msg-33093</guid>
      <pubDate>Mon, 18 Jan 2010 09:25:14 -0600</pubDate>
    </item>
    <item>
      <title>Re: how i found a CSRF Bug ?</title>
      <link>http://sla.ckers.org/forum/read.php?4,33036,33088#msg-33088</link>
      <author>thrill</author>
      <description><![CDATA[@rvdh - you are suck. ;)]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,33036,33088#msg-33088</guid>
      <pubDate>Sun, 17 Jan 2010 13:39:42 -0600</pubDate>
    </item>
    <item>
      <title>Re: how i found a CSRF Bug ?</title>
      <link>http://sla.ckers.org/forum/read.php?4,33036,33087#msg-33087</link>
      <author>rvdh</author>
      <description><![CDATA[yes and no teh inpuds forms haz no secure wen c0de is nothing from securities eh?. But not sure about tho, but I know is it based on CEESURFING somhow.]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,33036,33087#msg-33087</guid>
      <pubDate>Sun, 17 Jan 2010 12:33:56 -0600</pubDate>
    </item>
    <item>
      <title>Re: how i found a CSRF Bug ?</title>
      <link>http://sla.ckers.org/forum/read.php?4,33036,33083#msg-33083</link>
      <author>the_master</author>
      <description><![CDATA[ok, but all inputs/forms has no secure ?]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,33036,33083#msg-33083</guid>
      <pubDate>Sun, 17 Jan 2010 07:10:04 -0600</pubDate>
    </item>
    <item>
      <title>Re: Firefox Multi-lined Address Phishing</title>
      <link>http://sla.ckers.org/forum/read.php?4,32660,33062#msg-33062</link>
      <author>p0deje</author>
      <description><![CDATA[problem is that it's impossible to make urlbar scroll down without user manipulation]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,32660,33062#msg-33062</guid>
      <pubDate>Fri, 15 Jan 2010 05:36:38 -0600</pubDate>
    </item>
    <item>
      <title>Re: how i found a CSRF Bug ?</title>
      <link>http://sla.ckers.org/forum/read.php?4,33036,33059#msg-33059</link>
      <author>thornmaker</author>
      <description><![CDATA[you just need to the server with a and when the user then your all done]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,33036,33059#msg-33059</guid>
      <pubDate>Thu, 14 Jan 2010 21:51:03 -0600</pubDate>
    </item>
    <item>
      <title>Re: how i found a CSRF Bug ?</title>
      <link>http://sla.ckers.org/forum/read.php?4,33036,33051#msg-33051</link>
      <author>rvdh</author>
      <description><![CDATA[CSRF does not exist, it was all a joke to weed out signals from the n00b noize.]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,33036,33051#msg-33051</guid>
      <pubDate>Thu, 14 Jan 2010 14:37:38 -0600</pubDate>
    </item>
    <item>
      <title>how i found a CSRF Bug ?</title>
      <link>http://sla.ckers.org/forum/read.php?4,33036,33036#msg-33036</link>
      <author>the_master</author>
      <description><![CDATA[hi all,
i want to learn a CSRF,but i know it is.

but i dont know how is based..

thanks]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,33036,33036#msg-33036</guid>
      <pubDate>Thu, 14 Jan 2010 09:53:06 -0600</pubDate>
    </item>
    <item>
      <title>Re: Firefox Multi-lined Address Phishing</title>
      <link>http://sla.ckers.org/forum/read.php?4,32660,32919#msg-32919</link>
      <author>SpoofGhost</author>
      <description><![CDATA[i think this could be used with a redirect, i'm sure there are site's wich are quite good protected but if you can force a redirect with the characters to your phishing site. and they can't see in the url bar that there on the wrong site.
they might think oh i probably have deleted it orso.

so it can be used in an attack not sure what more is possible with this tho]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,32660,32919#msg-32919</guid>
      <pubDate>Thu, 07 Jan 2010 07:52:43 -0600</pubDate>
    </item>
    <item>
      <title>Re: Data encoding - crackable?</title>
      <link>http://sla.ckers.org/forum/read.php?4,32771,32867#msg-32867</link>
      <author>Perow</author>
      <description><![CDATA[Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.7a PHP/5.1.6
X-Powered-By: PHP/5.1.6

Is that what you were looking for?]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,32771,32867#msg-32867</guid>
      <pubDate>Tue, 29 Dec 2009 07:59:43 -0600</pubDate>
    </item>
    <item>
      <title>Re: Data encoding - crackable?</title>
      <link>http://sla.ckers.org/forum/read.php?4,32771,32838#msg-32838</link>
      <author>rvdh</author>
      <description><![CDATA[What language/platform? .NET, PHP, JSP, Ruby? answers to that could help.]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,32771,32838#msg-32838</guid>
      <pubDate>Sat, 26 Dec 2009 15:48:50 -0600</pubDate>
    </item>
    <item>
      <title>Re: Data encoding - crackable?</title>
      <link>http://sla.ckers.org/forum/read.php?4,32771,32788#msg-32788</link>
      <author>Perow</author>
      <description><![CDATA[Thanks for the idea. Below is the output of something I tried: I set up a multi-threaded script to log in several times on three different accounts. This is what I learnt.

x - Turns out to be not so random. Every time I ran the program, the values were kind of close together. I'm guessing it might be a number of miliseconds?
y - Is definitely a timestamp. In the output below, the timestamps are all identical (per run).
z - can not be the user id, because it is the same for all users I try it with. I think it's probably some kind of temporary constant shared among all users?

The output might look interesting to people who know a bit more about this than I do. All I noticed is that the (probably) SH1 hash turned out the same for some tries with different input.

PS - I removed the usernames but gave them clear names so you can see what belongs to whom. I also printed the thread number after the username.
PPS - The spacing in the IN paramater were added by me to make it more readable.

[code]

in: 751742 436106 193190253147
out: b96b7ab1efa991e4bd98fa04b456295e2bcb8153


in: 775424 436106 193190253147
out: 670f6d00ff112acc61c250b3c72bb44aa3d401d9


in: 707345 436106 193190253147
out: 670f6d00ff112acc61c250b3c72bb44aa3d401d9


in: 709467 436106 193190253147
out: 5342f078b3dd746fdabd98f191442fa0c5543e04


in: 711520 436106 193190253147
out: 52633aff95e6d79af42e37d06faa2da6d945c9bb


in: 761698 436106 193190253147
out: 52633aff95e6d79af42e37d06faa2da6d945c9bb


in: 706059 436106 193190253147
out: 52633aff95e6d79af42e37d06faa2da6d945c9bb


in: 805119 436106 193190253147
out: ac78229d2714720496c660aa8692ebc41db4151b

***


in: 579155 436495 193190253147
out: 1765b939adb77fdd4441dc0099e9c1ecf7fbc2aa


in: 623072 436495 193190253147
out: e5d1c19454d786a9d9f3c9af22bf00509fcf995f


in: 677815 436495 193190253147
out: 0458fc8976c8ccb4a89238c9480f86d4f443ed8f


in: 709763 436495 193190253147
out: 9f207937f9e3eb013e7a256bc089823e15016d2c


in: 677207 436495 193190253147
out: 5f4a9a9bf470d5049140c9d7aadae4a34122e549


in: 613721 436495 193190253147
out: 805bc4ea7998b6ea40397786f8c71772691ab97b


in: 647900 436495 193190253147
out: b5dce8da48670be899310ae035528007d31931f5


in: 639711 436495 193190253147
out: 2d1b72852ff5d83efd9359eb7c0f1a09f9e9d95b


in: 694139 436495 193190253147
out: 76d38393b2c22c544679f6a8070a5b6a1a2e27ce


in: 830006 436495 193190253147
out: 76d38393b2c22c544679f6a8070a5b6a1a2e27ce


***


in: 558724 436650 193190253147
out: 2f9223bd2db1f95068e0ed347c7deed72aab6598


in: 552689 436650 193190253147
out: 6cbb2c33217d43f8ac262d61f9a8b35b13114f0c


in: 546384 436650 193190253147
out: 6cbb2c33217d43f8ac262d61f9a8b35b13114f0c


in: 565900 436650 193190253147
out: 6cbb2c33217d43f8ac262d61f9a8b35b13114f0c


in: 586881 436650 193190253147
out: 14083e1a4950dae1ddb3d6928f5b4c9f77967aac


in: 835875 436650 193190253147
out: cac7ffb574a6f965199be49e57205cfae3b65396


in: 553437 436650 193190253147
out: cac7ffb574a6f965199be49e57205cfae3b65396


in: 611176 436650 193190253147
out: 7791fb46a662b3ba193a027a9554f0464581e31c


in: 638917 436650 193190253147
out: b56dc61fc639bbd8083f8f0802f1ff62761b2320


in: 547212 436650 193190253147
out: e351e0965e94aeb3db6178bd837bfb455faca2ad


in: 653580 436650 193190253147
out: aa30bc3165853b9eba3edccd69ecd45cbe4ff59e

***


in: 000502 436788 193190253147
out: f74753e2f85754152cc92e1e5a2aa4a16b30eac8


in: 067736 436788 193190253147
out: 4cce44f667af6c1fe13a5817f1483cf90712d1d8


in: 133465 436788 193190253147
out: da7fabead838175eb9d511ac456546fd8ffc5c27


in: 013285 436788 193190253147
out: 35cbb612fd6fd2f633a4ef7fa983dd61d014cd0d


in: 018139 436788 193190253147
out: e2063172fe266e7aa129fe16bad22b40d968267e


in: 126620 436788 193190253147
out: d4f5882ee453b87d220c96dc655843d437d8d081


in: 121206 436788 193190253147
out: b8fdfefed46918c69108d24359acc31ff81e7fad


in: 234347 436788 193190253147
out: 1ea4abddae562d5349e3b67c95e7e033ca40009b


in: 134169 436788 193190253147
out: 37879afa15cb9d9f9c816523c789ccea8dc804e5


***


in: 928062 436869 193190253147
out: 28e3f5be55b9c4009ab2e9af2a9588271d7667c2


in: 984465 436869 193190253147
out: e8435f8d23f56857c5e8f91f231f81cd2d028150


in: 003029 436870 193190253147
out: e8435f8d23f56857c5e8f91f231f81cd2d028150


in: 945768 436869 193190253147
out: f3a322151ef908cc7d16498a03ed6d5978b90ecf


in: 836975 436869 193190253147
out: be453efc4642f2b6c31f4bff6e376ec4a59da017


in: 847820 436869 193190253147
out: 71792048c261e84ac6e62ae2b7ec9b9f0f0f9533


in: 894029 436869 193190253147
out: 3b34ca85f8ddb39552dd4866898d5c54ce30c47f


in: 951477 436869 193190253147
out: d8172923028a90785199489252c273eb248cff35


in: 898867 436869 193190253147
out: 5f8c58c78cc4cabd346264072923aaca0ec9ed43


in: 904879 436869 193190253147
out: 664eff0ed62bd38c5fa00f886cc03416ac72ca1e


in: 903745 436869 193190253147
out: 664eff0ed62bd38c5fa00f886cc03416ac72ca1e
[/code]]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,32771,32788#msg-32788</guid>
      <pubDate>Mon, 21 Dec 2009 17:25:28 -0600</pubDate>
    </item>
    <item>
      <title>Re: Data encoding - crackable?</title>
      <link>http://sla.ckers.org/forum/read.php?4,32771,32785#msg-32785</link>
      <author>barbarianbob</author>
      <description><![CDATA[See what information you can gather from the &quot;in&quot; value.
Here's what I see so far:

format: xxxxxxyyyyyyzzzzzzzzzzz
x - random
y - related to either timestamp or a login id
z - constant; might be user id

Can you try logging in twice on the same second (server time), to see how y changes? The lazy way is to open two tabs, while using the firefox addon HttpFox to log the data. If both have the same Date response header, then check the &quot;in&quot; cookie values.

Also see what changes when you log into a different account.]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,32771,32785#msg-32785</guid>
      <pubDate>Mon, 21 Dec 2009 13:52:29 -0600</pubDate>
    </item>
    <item>
      <title>Re: Data encoding - crackable?</title>
      <link>http://sla.ckers.org/forum/read.php?4,32771,32774#msg-32774</link>
      <author>Perow</author>
      <description><![CDATA[I cannot try to enter the same value multiple times, because this is how it works:

1. log in to website: the site generates the &quot;in&quot; code and stores it on their servers.
2. the site generates the output hash from the input file (and possibly some other data?)
3. a cookie gets stored. it contains the in code, as well as the output hash.
4. I can reduce the cookie to only the part containing the output hash and it still works to log in.

So every time I log in, a new input is used, disabling me to get the same output twice. I still think it's possible to generate the output from the input because the reduced cookie can let me log in. I think the site just rehashes the input code they store on their servers and compare it to the cookie string.

All of the strings above were generated for the same user.]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,32771,32774#msg-32774</guid>
      <pubDate>Mon, 21 Dec 2009 03:08:56 -0600</pubDate>
    </item>
    <item>
      <title>Re: Data encoding - crackable?</title>
      <link>http://sla.ckers.org/forum/read.php?4,32771,32772#msg-32772</link>
      <author>barbarianbob</author>
      <description><![CDATA[Well, it's hashing them, and I assume it's sha1() since it's 40 chars long.
What happens if you enter a value multiple times? As in 44517835668088197224117, wait a few seconds, and 44517835668088197224117 again. What's some of the other data that comes out?]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,32771,32772#msg-32772</guid>
      <pubDate>Sun, 20 Dec 2009 20:24:06 -0600</pubDate>
    </item>
    <item>
      <title>Data encoding - crackable?</title>
      <link>http://sla.ckers.org/forum/read.php?4,32771,32771#msg-32771</link>
      <author>Perow</author>
      <description><![CDATA[Hey all,
I've been trying to decipher the cookie structure of a website and am hopeful some of you have more experience in this matter.

There is a certain passphrase in the website's cookie that allows the user to be logged in without explicitly entering any user data. The cookie comes with a lot of extra useless data, because I found that it's possible to reduce the complete cookie string to only the specific part and it would still work.
Now, I was able to find a different part of the cookie that is also stored on the website. Let's call this the input code &quot;in&quot;.

What I'm interested in, is whether or not it's possible to find the ouput hash with help of the input code on the site's server. Below is a list of in&amp;out combinations I have generated, that may help you to decide how or if it's possible to generate &quot;out&quot; from &quot;in&quot;.

[code]
in: 93335735519988197224117
out: b6e61a57b71e9e805af2de6d4f6aa5ab8bb53cfb

in: 26195435616488197224117
out: 440ea6883091823653dafb01520713d4d6fba522

in: 45411135623788197224117
out: b1a32caf51f12de9f3b0eb9c6a4ed797a292c066

in: 01935335659288197224117
out: 5f64da5e645f3367c4ba0311b2063471563b5b58

in: 34029335659488197224117
out: 3efac60e094404311c306a98caf4711bc7417048

in: 24941135659688197224117
out: d575dbba4c7634d877b0696d9db96ea85b24b11c

in: 24665335659888197224117
out: a4955c063cae03039511e932d29aa7308f0e9a3c

in: 48274935660088197224117
out: f6b73696395d44bc0ddd98db2cccc2e94b18f1c6

in: 54058135660288197224117
out: c5cd59f1639a0d943ca7e273e46ca8e933f89c1b

in: 64959135660488197224117
out: 77ec22260b4503c7591a7fa590a1a8633b874d99

in: 64955535660688197224117
out: d76d7501c66d6f7a4eb0798c86b5f60c25246059

in: 79520035661188197224117
out: faba8080c07b0ca455f2940a93d21ba0f51004e1

in: 06291335661488197224117
out: 0144a1df977226f993d67e89bb8ee11bf721316f

in: 39539235661688197224117
out: 8dc7099f26b942cc0c7fd9e2e257906b30166d08

in: 29120835661888197224117
out: a19f2d206fd154ac70e0994b803b1fe2569f99c1

in: 38387535662088197224117
out: 883c069b719a2b71a4c50fa28060a027b52a46b5

in: 47230635662288197224117
out: 3f8e958366dd48bab8ef34d1a7c7b05a3c418417

in: 69501335662488197224117
out: ee06c267ed970b36a24bd54c88a42e330c078788

in: 16766335666288197224117
out: 092d28d8786382785118b1b80c50465c62fb1c6e

in: 27683335666488197224117
out: dda146137769e62607b842e5a659e3d9f89e4127

in: 30534435666688197224117
out: 8c9230934d6797fae76850af74b34d3333949ffc

in: 18607535666888197224117
out: eaaf196f69e3d087bf54c19a6d9cd97cd3dd0e7f

in: 07154035667088197224117
out: 8a08a3631f531ab2b9c2c3ca7b193c3d96849473

in: 04457435667288197224117
out: ae49a2888c3a1445171b6d87dd95ba24ce21c22c

in: 33087635667488197224117
out: 91b55929d7a5f5cd35715dfbfc6d811b4043db11

in: 36115435667688197224117
out: b2179689e8c16df7229b24b6c145401f8b561159

in: 36958935667888197224117
out: d2dca1254b96c5be66c34892dca3897accea7e38

in: 44517835668088197224117
out: 531494e84e2336404a1ee9d473204c9843eb92f5
[/code]

Thanks.]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,32771,32771#msg-32771</guid>
      <pubDate>Sun, 20 Dec 2009 19:18:36 -0600</pubDate>
    </item>
    <item>
      <title>Re: browser protocol hacks</title>
      <link>http://sla.ckers.org/forum/read.php?4,29857,32680#msg-32680</link>
      <author>timb</author>
      <description><![CDATA[You might want to take a look at KDEs IO slaves... some fun to be had there:

http://www.portcullis-security.com/329.php]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,29857,32680#msg-32680</guid>
      <pubDate>Sat, 05 Dec 2009 11:50:53 -0600</pubDate>
    </item>
    <item>
      <title>Re: Firefox Multi-lined Address Phishing</title>
      <link>http://sla.ckers.org/forum/read.php?4,32660,32665#msg-32665</link>
      <author>p0deje</author>
      <description><![CDATA[jackthecoiner Wrote:
-------------------------------------------------------
&gt; Are there particular language packs that need to
&gt; be required for the scrolling to happen on
&gt; Windows?

I think no
You just need Firefox of version 3, which decodes URL to UTF-8]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,32660,32665#msg-32665</guid>
      <pubDate>Fri, 04 Dec 2009 01:34:22 -0600</pubDate>
    </item>
    <item>
      <title>Re: Firefox Multi-lined Address Phishing</title>
      <link>http://sla.ckers.org/forum/read.php?4,32660,32664#msg-32664</link>
      <author>jackthecoiner</author>
      <description><![CDATA[Are there particular language packs that need to be required for the scrolling to happen on Windows?]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,32660,32664#msg-32664</guid>
      <pubDate>Thu, 03 Dec 2009 18:34:56 -0600</pubDate>
    </item>
    <item>
      <title>Re: Firefox Multi-lined Address Phishing</title>
      <link>http://sla.ckers.org/forum/read.php?4,32660,32662#msg-32662</link>
      <author>p0deje</author>
      <description><![CDATA[for example, we have URL

www.hacksite.com/%E2%A4%80 \r\n 
www.phishedsite.com

and if address bar will be scrolled, user will see www.phishedsite.com in address bar and think it's a valid site]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,32660,32662#msg-32662</guid>
      <pubDate>Thu, 03 Dec 2009 08:14:51 -0600</pubDate>
    </item>
    <item>
      <title>Re: Firefox Multi-lined Address Phishing</title>
      <link>http://sla.ckers.org/forum/read.php?4,32660,32661#msg-32661</link>
      <author>lightos</author>
      <description><![CDATA[%E2%A4%80 is the character causing the trouble, a whole range of characters seem to have the same effect.
It didn't work for me on linux, but works on FF and Opera running under Windows. Opera actually expands the URL box hehe.
Can't really see this being used for an attack, although I may be wrong.]]></description>
      <category>CSRF and Session Info</category>
      <guid isPermaLink="true">http://sla.ckers.org/forum/read.php?4,32660,32661#msg-32661</guid>
      <pubDate>Thu, 03 Dec 2009 07:53:30 -0600</pubDate>
    </item>
  </channel>
</rss>
