From: Micheal Thompson (MThompson@brinkster.com)
Date: Wed Dec 03 2003 - 11:19:26 EST
You can spoof any IP. The question is do you want the return traffic.
-----Original Message-----
From: pire pire [mailto:pirepire69@romandie.com]
Sent: Tuesday, December 02, 2003 5:02 PM
To: pen-test@securityfocus.com
Subject: Session & IP Spoofing
Hi,
I've found a vulnerability in a Web App which
gave me via an XSS the sessionID token.
I would like to replay this token. But the
session ID manager (on the server) seems to look
also to IP adresses.
So my question is: Is there a way to spoof my ip
address in order to replay the sessionID??
Like:
http://www.tutu.com/toto.php?sessionid=32443243
and some how spoof of my IP?!
If I replay the sessionid from my machine or an
other machine behind my NAT (same outside IP) it
works!!
Thanks a lot for your help
_______________________________________________
La messagerie gratuite des romands : 10 MO !!!
Profitez-en ! >>> http://www.romandie.com
------------------------------------------------------------------------
--- ------------------------------------------------------------------------ ---- --------------------------------------------------------------------------- ----------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:43 EDT