3 ms·
Wow, just piping the output from this proof of concept python script through grep and searching for the string "pass" shows that on a number of sites that are v
by blantonl 13y ago
Wow, just piping the output from this proof of concept python script through grep and searching for the string "pass" shows that on a number of sites that are vulnerable it is that easy to pull a logged in user's username and password.
Scary...
- gatehouse 13y agoYeah, up until very recently it would be possible to make a script that would log you into a random yahoo mail account. For vulnerable servers right now it would be better to just block port 443, forcing regular HTTP is safer.
- danielweber 13y agoAlthough there are no guarantees there, what you are likely getting is people logging in very recently because their POST request is still in memory. If you were just logged in with an old session from a few hours ago, it's unlikely your PUSH request will still be in memory. But every time you connect you are sending a cookie which allows for session hijacking.