full-disclosure - Security regarding PHP's default session handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CACRQBjDQycGhocsB18Q--h0VbVG8WGw+JiC0-pOnMppPfuOhLg@mail.gmail.com>
Date: Thu, 13 Oct 2011 09:22:16 +0200
From: Mango <h@...r.se>
To: websecurity@...ts.webappsec.org, full-disclosure@...ts.grok.org.uk, 
	websec10@...-sec.org
Subject: Security regarding PHP's default session handling

Hi List.

I've done a few writeups on local security concerns regarding PHP's
default session handling, that I thought might interest you. There are
some new research bundled with a lot of old information which I've
compiled together with technical informative descriptions and POC
exploit code.

Local Session Hijacking in PHP
http://ha.xxor.se/2011/08/local-session-hijacking.html

Local Session Snooping in PHP
http://ha.xxor.se/2011/08/local-session-snooping-in-php.html

Local Session Poisoning in PHP Part 1: The Basics of Exploitation and
How to Secure a Server
http://ha.xxor.se/2011/09/local-session-poisoning-in-php-part-1.html

Local Session Poisoning in PHP Part 2: Promiscuous Session Files
http://ha.xxor.se/2011/09/local-session-poisoning-in-php-part-2.html

Local Session Poisoning in PHP Part 3: Bypassing Suhosin's Session Encryption
http://ha.xxor.se/2011/09/local-session-poisoning-in-php-part-3.html

/Mango

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/