5 ms·
My mistake. So you can get a valid login, but you can't know whom you'll be login in as, that is without doing some social engineering like with the irc example
by mariorz 17y ago
My mistake. So you can get a valid login, but you can't know whom you'll be login in as, that is without doing some social engineering like with the irc example. Impressive hack.
- xenophanes 17y agoi think if you get a valid login cookie, and use it, it will tell you what account you have in the top right.
- mariorz 17y agoWell obviously, but you couldn't do a brute force attack like this to a specific account.
- e1ven 17y agoI believe the implication is that you'd have a sessionid. Effectively, the username and password rolled into one unique number, stored in the cookie.
- dfranke 17y agoI think by 'specific account' he means 'chosen account', in which case he'd be correct without more targeted social engineering.