1,290 reputation
21239
bio website
location
age
visits member for 3 years, 11 months
seen Apr 15 at 7:28

May
5
awarded  Famous Question
Apr
13
accepted Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
@MikeScott It happens regularly.
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
I agree with your last comment, but I don't agree with your answer.
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
@k1DBLITZ I know many network people who will know to try by IP address, but won't think twice about getting an SSL error if they only get the error when accessing by IP, because there certs don't tend to have IPs in the AN field. It seems to be a pretty common scenario.
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
@MikeScott, your input seem to ignore real world use cases, or how real users behave. Or both.
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
Thanks for your answer. To clarify my second point, imagine a scenario where an attacker has sabotaged or taken down DNS, so a user has to connect via IP address (a savvy enough user to know how to do so, but not knowledgeable on security). Now when the user connects via IP and the cert isn't valid, isn't it trivial to MitM at this stage?
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
Mike, there seems to be a misunderstanding. A certificate when implemented correctly, will not cause the browser to throw a warning. A warning will be caused from someone trying to MitM a connection. A cert without an IP in the AN field will do the same if the site is accessed by IP, invalidating any use the cert would have, as the user can't tell if is is trustworthy or not. An error will be thrown by any unrecognized cert, so the warning is not an argument for the cert having value.
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
Right, so the user won't know if they can accept the certificate or not - which makes it kind of useless in that situation, does it not?
Apr
13
asked Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
Apr
7
awarded  Notable Question
Mar
3
awarded  Benefactor
Mar
3
accepted Do WebGoat style XSS attacks still work?
Mar
2
comment Do WebGoat style XSS attacks still work?
Aatif you were the first to suggest it and I do appreciate your answer but I feel that Michael deserves it for delving into the issue as he did, and his comprehensive answer. If I could split the bounty up I would.
Mar
2
comment Do WebGoat style XSS attacks still work?
The header seems irrelevant, from what I can tell. If I prevent the cookie from being httponly, then the lessons work as intended without me having to set the header. The header does not allow the cookies to be accessed it the httponly flag is set.
Mar
2
comment Do WebGoat style XSS attacks still work?
I'm not sure who to award the bounty to, as the actual issue is simply that the cookie was set to httponly, which is why the webgoat lesson fails. I'm unsure how you completed stage 3, since for me setting the header did not change anything.
Mar
2
comment Do WebGoat style XSS attacks still work?
Yes, it definitely is. Well, that solves that. Thanks Michael.
Mar
2
comment Do WebGoat style XSS attacks still work?
Well, that is interesting. Looking at cookies.localhost in chrome, the cookie is marked as httponly. However, when monitoring traffic, the httponly tag does not seem to be set on cookie creation. Firefox also does not consider the cookie to be httponly, while Chrome does. I guess this looks like a question for stack overflow.
Mar
2
comment Do WebGoat style XSS attacks still work?
The cookie does seem to exist though, there must be a bug somewhere. Setting a dummy cookie worked, but the webgoat cookie still shows in the browser and on the webgoat page which lists cookies (which also now lists my dummy cookie).
Mar
2
revised Do WebGoat style XSS attacks still work?
added 652 characters in body