Recent Features
| |||||||||||||
Password takeoverPassword takeoverPosted Nov 4, 2010 20:18 UTC (Thu) by Simetrical (guest, #53439)In reply to: Password takeover by corbet Parent article: Gathering session cookies with Firesheep
What sites allow e-mail reset of passwords but don't require you to re-enter your password to change your e-mail?
(Log in to post comments)
Password takeover Posted Nov 17, 2010 12:58 UTC (Wed) by DonDiego (subscriber, #24141) [Link]
If you capture the insecure session cookie as described in the article, you don't need to enter a password.
Password takeover Posted Nov 18, 2010 0:52 UTC (Thu) by bfields (subscriber, #19510) [Link] Try it. Go to facebook, and try to change your email address or your password without re-entering your password. You'll find it doesn't let you, even though you've given it a session cookie. And that's by design....
|
|||||||||||||