full-disclosure - Yahoo webmail 1-day cookie stealing POC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <05b201c68ffa$2aa54cf0$650ba8c0@DORKA>
Date: Wed Jun 14 22:35:27 2006
From: very at unprivate.com (php0t)
Subject: Yahoo webmail 1-day cookie stealing POC

  Found a new javascript escape for yahoo webmail, works with explorer,
cookie stealing can begin yet again.
You must give a correct source address to be able to get a cookie. Do
not abuse, thx.

Proof-of-concept (kind-of):

http://zmailhost.ath.cx/

php0t
www.zorro.hu