Questions about this topic? Sign up to ask in the talk tab.

XSCF

From NetSec
Revision as of 05:13, 5 October 2011 by User (Talk | contribs) (Created page with "Cross-Site Content Forgery is a vulnerability class that entails malforming the server-side mimetype for a particular resource to make it appear as something else. This is by no...")

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Cross-Site Content Forgery is a vulnerability class that entails malforming the server-side mimetype for a particular resource to make it appear as something else. This is by no means original, however the Facebook wiki documents how to do this in detail.

For example, let's say you have an image sitting somewhere that looks innocent. Using Apache directives such as AddType, you can force the content-type of the resource to be processed server-side by any program. The program then seizes control of the resource, and you can then wrap the resource into the functions of the program that is being executed to return output to the client.