5

We're currently having our website pentested, and looking through our logs, a cookie we set (our allowCookies cookie) has had the value set to http%3a%2f%2fawebsite.net%2ff517a2bc19bdff66d7c64e8a7ad2f043.txt. That text file contains the string 3ac3bbfe0cb16c0ff90fc0c0fcb21764.

What kind of vulnerability would this exploit?

Improve this question

1 Answer 1

Reset to default
6

The intent would have been to exploit a server side include -- your webserver retrieving the URL and incorporating it into the web page.

This vulnerability isn't very common anymore.

Improve this answer
3
  • Ahh I see. I thought it was maybe trying to get the file included in the webpage. Would that be an include coded by myself, or is it something older webservers used to do?
    – TMH
    Commented Oct 6, 2014 at 12:30
  • It would be something coded by yourself. The pentesting tool they're using likely attempts this with every cookie it sees being set.
    – kronicd
    Commented Oct 6, 2014 at 12:32
  • 2
    I've noticed the url did move between cookies. That will also explain why the url ../../../../../etc/passwd was tested a few times then!
    – TMH
    Commented Oct 6, 2014 at 12:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .