lavalair session sid and brute force attack

[something else]

Server sessions are only safe if you know how to protect your site from other malicious attacks that you don't get with the session in the url.
You cant just change from a session in the url to a Server session and think that it is safer - (its actually much more dangerous if unprotected)

[wapxtech]

cookies is much easier to steal than url session

[creative785]

Server sessions are only safe if you know how to protect your site from other malicious attacks that you don't get with the session in the url.
You cant just change from a session in the url to a Server session and think that it is safer - (its actually much more dangerous if unprotected)

Hi.. you mean, like you mentioned in your previous topics that, hackers can make someone LOGOUT by just giving the link? (if we use sessions).. you mean that bro? right.?

[something else]

Yes not to mention many other ways from cross site scripting to an uploader session attack - and logging out could be the least of your worries

[something else]

wapxtech commented

cookies is much easier to steal than url session




I wouldn't say either is easier to steal than the other - The only reason url sessions get stolen more is because people dont know how to edit there own cookies on there web browser (vs editing a url is simple)

[wapxtech]

wapxtech commented

cookies is much easier to steal than url session




I wouldn't say either is easier to steal than the other - The only reason url sessions get stolen more is because people dont know how to edit there own cookies on there web browser (vs editing a url is simple)

yeah, its much easier to copy and paste the url, BUT if the dev will add some twist in his coding it is much harder for the hacker to execute, for e.g i will use url session "BUT" i will add some random hashes (timestamps would do) that will be saved in the database that will match the url session if it does not match its invalid.. so that if you will do copying and pasting url it will not work. plus matching it with ip/browser if you use other ip/browser your session is invalid.. If you wer a real dev it is easy for you to do that, me my self i can.. btw, im using cookies (more professional and much cleaner urls) in my site bcoz im pretty sure my site is not vulnerable to xss by simply using htmlentities() and htmlspecialchars().

im telling this to motivate those who are using url sessions and giving them brilliant idea how to improve their security.

[something else]

I would so love to challenge that your site is secure from all xss attacks - Could be fun but I'm not going down that route

[creative785]

Sessions creating problem now. Its working fine for me. but for my frends using UC browser are gettn logged out everytime.

[something else]

UC Web browser is sh*t - I would not even bother trying to script something to make that web browser work.
You wont get paid for any UCWeb Traffic - So no point in trying to make your site work for a browser that sucks.
however if you really want that sh*t browser to work on your site then take down your ip protection and it should work fine >.<