« Nmap 5.00 Released | Main | One In Two Security Pros Unhappy In Their Jobs? »

Hacking Short CSRF Tokens using CSS History Hack

Securethoughts has posted an entry on combining CSS history theft hacking to brute force short CSRF tokens and has created a POC demonstrating it. While not fast this is certainly achievable (assuming the token is still valid/hasn't expired once identified) on short CSRF token values, and has the advantage in that it doesn't perform site requests which doesn't risk invalidating the user's session on invalidly guessed tokens. Yet another use for CSS history theft.

Read more: http://securethoughts.com/2009/07/hacking-csrf-tokens-using-css-history-hack/


Feed You can follow this conversation by subscribing to the comment feed for this post.

All Comments are Moderated and will be delayed!