Martin, Were you able to code something? If you need some help, please let me know.
Cheers, On Mon, Nov 23, 2009 at 6:39 PM, Martin Tartarelli <martin.tartare...@gmail.com> wrote: > Andres, > > 2009/11/23 Andres Riancho <andres.rian...@gmail.com>: >> Guys, >> >> Anybody has time to code a new audit plugin, that will find >> session fixation vulnerabilities? > > I have 2 Saturdays....will this be enough? =) > >> >> Basically the plugin needs to: >> >> - Read if there is a current cookie parameter names (PHPSESSID=... ; >> FOOBAR=...) >> >> - Append the cookie parameter to the URL: >> * /the/url/?id=1&PHPSESSID=w3af-session-fixation >> * /the/url/?id=1&FOOBAR=w3af-session-fixation >> >> - Analyze the response of each request, and see if there is a >> set-cookie header in the response with the w3af-session-fixation >> string. >> >> I could do it, but I would rather delegate this task, as it is >> simple, and someone that is starting to develop in w3af can learn a >> lot by giving it a try. >> > > If possible... I will try to develop this plugin > >> Thanks! >> >> Cheers, >> -- >> Andrés Riancho >> Founder, Bonsai - Information Security >> http://www.bonsai-sec.com/ >> http://w3af.sf.net/ >> >> ------------------------------------------------------------------------------ >> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day >> trial. Simplify your report design, integration and deployment - and focus on >> what you do best, core application coding. Discover what's new with >> Crystal Reports now. http://p.sf.net/sfu/bobj-july >> _______________________________________________ >> W3af-develop mailing list >> W3af-develop@lists.sourceforge.net >> https://lists.sourceforge.net/lists/listinfo/w3af-develop >> > > -- > Martin Tartarelli > Linux User #476492 > http://owasp.org/index.php/Argentina > -- > -- Andrés Riancho Founder, Bonsai - Information Security http://www.bonsai-sec.com/ http://w3af.sf.net/ ------------------------------------------------------------------------------ This SF.Net email is sponsored by the Verizon Developer Community Take advantage of Verizon's best-in-class app development support A streamlined, 14 day to market process makes app distribution fast and easy Join now and get one step closer to millions of Verizon customers http://p.sf.net/sfu/verizon-dev2dev _______________________________________________ W3af-develop mailing list W3af-develop@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/w3af-develop