Cross-site cooking

Cross-site cooking is a type of browser exploit which allows a site attacker to set a cookie for a browser into the cookie domain of another site server.

Cross-site cooking can be used to perform session fixation attacks, as a malicious site can fixate the session identifier cookie of another site.

Other attack scenarios may also be possible, for example: attacker may know of a security vulnerability in server, which is exploitable using a cookie. But if this security vulnerability requires e.g. an administrator password which attacker does not know, cross-site cooking could be used to fool innocent users to unintentionally perform the attack.

Cross site. Cross-site cooking is similar in concept to cross-site scripting, cross-site request forgery, cross-site tracing, cross-zone scripting etc., in that it involves the ability to move data or code between different web sites (or in some cases, between e-mail / instant messages and sites). These problems are linked to the fact that a web browser is a shared platform for different information / applications / sites. Only logical security boundaries maintained by browsers ensures that one site cannot corrupt or steal data from another. However a browser exploit such as cross-site cooking can be used to move things across the logical security boundaries.

Origins

The name cross-site cooking and concept was presented by Michał Zalewski in 2006.^[1] The name is a mix of "cookie" and "cross-site", attempting to describe the nature of cookies being set across sites.

In Michał Zalewski's article of 2006, Benjamin Franz was credited for his discovery, who in May 1998 reported a cookie domain related vulnerability to vendors. Benjamin Franz published the vulnerability and discussed it mainly as a way to circumvent "privacy protection" mechanisms in popular browsers. Michał Zalewski concluded that the bug, 8 years later, was still present (unresolved) in some browsers and could be exploited for cross-site cooking. Various remarks such as "vendors [...] certainly are not in a hurry to fix this" were made by Zalewski and others.

References

^ Browsers face triple threat(Techworld.com)

External links

Cross-Site Cooking article by Michal Zalewski. Details concept, 3 bugs which enables Cross Site Cooking. One of these bugs is the age old bug originally found by Benjamin Franz.

This security software article is a stub. You can help Wikipedia by expanding it.

Read other articles:

Chris Evert

Chris EvertEvert in the 1980s[1]Nama lengkapChristine Marie EvertKebangsaan Amerika SerikatTempat tinggalBoca Raton, FloridaLahir21 Desember 1954 (umur 69)Fort Lauderdale, FloridaTinggi168 cm (5 ft 6 in)Memulai pro1972Pensiun5 September 1989Tipe pemainTangan kanan (two-handed backhand)PelatihJimmy EvertDennis Ralston[2]Total hadiah$8,895,195Int. Tennis HoF1995 (member page)TunggalRekor (M–K)1309–146 (90.0%)Gelar157Peringkat tertinggiNo. 1 (3 Novemb...

Daftar Menteri Ekonomi Malaysia

Menteri Ekonomi MalaysiaMenteri Hal Ehwal Ekonomi Malaysia منتري حال إيهول ايكونومي مليسياPetahanaRafizi Ramlisejak 3 Desember 2022GelarYang Berhormat Menteri(Yang Terhormat Menteri)Ditunjuk olehYang di-Pertuan Agong atas rekomendasi Perdana Menteri MalaysiaDibentuk31 Agustus 1957; 66 tahun lalu (1957-08-31)Pejabat pertamaTajol Rosli Mohd Ghazali (sebagai Menteri di Departemen Perdana Menteri)Mohamed Azmin Ali (sebagai Menteri Ekonomi)Situs webmea.gov.my B...

Mike McKevitt

American politician (1928–2000) This article includes a list of general references, but it lacks sufficient corresponding inline citations. Please help to improve this article by introducing more precise citations. (March 2013) (Learn how and when to remove this template message) Mike McKevittMember of the Korean War Memorial CommissionIn office1987–1995PresidentRonald ReaganCounsel at White House Energy Policy OfficeIn office1973–1974PresidentRichard NixonPreceded byPosition createdSuc...

Maine's 6th congressional district

ME-6 redirects here. For the state route, see Maine State Route 6. Maine's 6th congressional districtObsolete districtCreated1821Eliminated1863Years active1821-1863 Maine's 6th congressional district is a former congressional district in Maine. It was created in 1821 after Maine achieved statehood in 1820. It was eliminated in 1863. Its last congressman was Frederick A. Pike. List of members representing the district Member Party Years ↑ Congress Electoral history District location District...

Seperti yang Kau Minta

Artikel ini sebagian besar atau seluruhnya berasal dari satu sumber. Diskusi terkait dapat dibaca pada the halaman pembicaraan. Tolong bantu untuk memperbaiki artikel ini dengan menambahkan rujukan ke sumber lain yang tepercaya.Seperti yang Kau MintaSingel oleh Chrisyedari album DekadeDirilis2002 (2002)FormatCDDirekam2001-2002GenrePopDurasi4:48LabelMusica Studio'sPenciptaPongki Barata Seperti yang Kau Minta adalah lagu yang dinyanyikan Chrisye. Dirilis pada tahun 2002, dan termasuk ke da...

コルク

この記事は検証可能な参考文献や出典が全く示されていないか、不十分です。出典を追加して記事の信頼性向上にご協力ください。（このテンプレートの使い方）出典検索?: コルク – ニュース · 書籍 · スカラー · CiNii · J-STAGE · NDL · dlib.jp · ジャパンサーチ · TWL（2017年4月）コルクを打ち抜いて作った瓶の栓コルク（木栓、�...

Highway 6 (Israel)

Highway in Israel Highway 6כביש 6 Trans Israel Highway Hebrew: כביש חוצה ישראל, romanized: Kvish Ḥotze Yisra'el Yitzhak Rabin Highway Hebrew: כביש יצחק רבין, romanized: Kvish Yitzḥak Rabin Highway near Horshim InterchangeRoute informationLength204 km (127 mi)Major junctionsSouth endShoket InterchangeMajor intersections Sorek Interchange Nesharim Interchange Ben Shemen Interchange Kessem Interchange Iron Interchange North endS...

Open reading frame

DNA section marked with start and stop codon of different length Sample sequence showing three different possible reading frames. Start codons are highlighted in purple, and stop codons are highlighted in red. In molecular biology, reading frames are defined as spans of DNA sequence between the start and stop codons. Usually, this is considered within a studied region of a prokaryotic DNA sequence, where only one of the six possible reading frames will be open (the reading, however, refers to...

Alexis Henríquez

Colombian footballer (born 1983) Alexis Henriquez Henriquez lining up for Atlético Nacional in 2016Personal informationFull name Alexis Hector Henriquez Charales[1]Date of birth (1983-02-01) February 1, 1983 (age 41)Place of birth Santa Marta, ColombiaHeight 1.91 m (6 ft 3 in)Position(s) Centre-backSenior career*Years Team Apps (Gls)2002–2011 Once Caldas 145 (6)2012–2019 Atlético Nacional 216 (7)International career2007–2010 Colombia 5 (0) *Club domestic le...

Boeing B-47 Stratojet

Pour les articles homonymes, voir B47. Boeing B-47 Stratojet Un B-47E Stratojet en vol ; il porte les couleurs de la 22nd Bombardment Wing du Strategic Air Command. Constructeur Boeing Rôle Bombardier Statut Retiré du service Premier vol 17 décembre 1947 Mise en service 1952 Date de retrait 1966 Nombre construits 2 042 appareils[1],[2] modifier Boeing B-47A Stratojet Le Boeing B-47 Stratojet est un bombardier moyen à réaction et à long rayon d'action mis en service...

Western Mail (Western Australia)

Australian newspapers The Countryman redirects here. For the British magazine, see Countryman (magazine). 7 April 1927 edition, with the Countryman behind The Western Mail, or Western Mail, was the name of two weekly newspapers published in Perth, Western Australia. Published 1885–1955 The 1897 Christmas Number The first Western Mail was published on 19 December 1885[1] by Charles Harper and John Winthrop Hackett, co-owners of The West Australian, the state's major daily paper. It w...

Yunieska Robles

Questa voce o sezione sull'argomento pallavolisti non è ancora formattata secondo gli standard. Contribuisci a migliorarla secondo le convenzioni di Wikipedia. Segui i suggerimenti del progetto di riferimento. Yunieska RoblesNazionalità Cuba Altezza185 cm Peso70 kg Pallavolo RuoloSchiacciatrice/Opposto Squadra Šygys Öskemen CarrieraSquadre di club ?-2012 Isla de la Juventud2012-2013 Lokomotiv Biləcəri2013-2014 Azərreyl2015 Al-Ahly2015- Šygys Ö...

Apsley House

Building in London, EnglandApsley HouseThe front of Apsley House in 2005Location within Central LondonGeneral informationArchitectural styleNeo-classicalLocation149 PiccadillyLondon, W1CountryUnited KingdomCoordinates51°30′13″N 0°09′06″W / 51.5035°N 0.1517°W / 51.5035; -0.1517ClientHenry Bathurst, Lord ApsleyArthur Wellesley, 1st Duke of WellingtonDesign and constructionArchitect(s)Robert Adam (original building)Benjamin Dean Wyatt(19th-century renovations...

1988–89 Miami Heat season

NBA basketball team season (inagaural season) NBA professional basketball team season 1988–89 Miami Heat seasonHead coachRon RothsteinGeneral managerLewis SchaffelOwners Ted Arison Billy Cunningham Lewis Schaffel ArenaMiami ArenaResultsRecord15–67 (.183)PlaceDivision: 6th (Midwest)Conference: 13th (Western)Playoff finishDid not qualifyStats at Basketball-Reference.comLocal mediaTelevisionWBFS-TV SportsChannel Florida(Sam Smith, Eric Reid)RadioWQAM(Sam Smith, Eric Reid)WAQI (Spani...

List of rabbis

Part of a series onJudaism Movements Orthodox Haredi Hasidic Modern Conservative Conservadox Reform Karaite Reconstructionist Renewal Humanistic Haymanot Philosophy Principles of faith Kabbalah Messiah Ethics Chosenness God Names Musar movement Texts Tanakh Torah Nevi'im Ketuvim Ḥumash Siddur Piyutim Zohar Rabbinic Mishnah Talmud Midrash Tosefta Law Mishneh Torah Tur Shulchan Aruch Mishnah Berurah Aruch HaShulchan Kashrut Tzniut Tzedakah Niddah Noahide laws Holy cit...

List of prime ministers of Syria

Politics of Syria Member State of the Arab League Constitution Preamble and Chapter 1 Chapter 2 Chapter 3 Chapter 4 Human rights Executive President (list) Bashar al-Assad Vice President Najah al-Attar Prime Minister (list) Hussein Arnous Deputy Prime Minister Ali Abdullah Ayyoub Legislature People's Assembly Speaker: Hammouda Sabbagh Judiciary High Judicial Council Supreme Constitutional Court Subdivisions Governorates Districts Subdistricts (Nahiyas) Villages Elections Recent elections Pre...

Latina Football Club Polisportiva 1979-1980

Voce principale: Unione Sportiva Latina Calcio. Latina Football Club PolisportivaStagione 1979-1980Sport calcio Squadra Latina Allenatore Guido Attardi, poi Cesare Meucci Presidente Franco Bassoli, Guido Girolami, Pasquale Papa (comitato di presidenza) Serie C27º posto nel girone C. Maggiori presenzeCampionato: Dozzi (34) Miglior marcatoreCampionato: Banella (8) 1978-1979 1980-1981 Si invita a seguire il modello di voce Questa pagina raccoglie le informazioni riguardanti il Latina Foot...

Jean-Baptiste Santerre

Autoritratto (1704) Jean-Baptiste Santerre (Magny-en-Vexin, 1º gennaio 1651 (o 23 marzo) – Parigi, 21 novembre 1717) è stato un pittore, disegnatore e docente francese, membro dell'Accademia reale di pittura e scultura. Indice 1 Biografia 2 Alcune Opere 3 Note 4 Bibliografia 5 Voci correlate 6 Altri progetti 7 Collegamenti esterni Biografia Susanna al bagno (1704) Formatosi alla scuola di Bon Boullogne e di François Lemaire[1], ritrattista[2], operò principalmente a...

Daughters of Utah Pioneers

Historical organization focusing on Utah, United States Pioneer Memorial Museum, DUP headquarters, Salt Lake City, Utah The International Society Daughters of Utah Pioneers (ISDUP, DUP) is a women's organization dedicated to preserving the history of the original settlers of the geographic area covered by the State of Deseret and Utah Territory, including Mormon pioneers. The organization is open to any woman who is: (1) A direct-line descendant or legally adopted direct-line descendant with ...

Strict constructionism

United States legal philosophy in which judges must interpret laws exactly as written Not to be confused with Originalism. Judicial interpretation Forms Constitutional interpretation Statutory interpretation General rules of interpretation Plain meaning rule Mischief rule Golden rule General theories of interpretation Living Constitution / Living tree / Living instrument Originalism (original meaning) Original intent(legislative intent, legislative history) Strict constructionism Textualism P...