Questions about this topic? Sign up to ask in the talk tab.
Difference between revisions of "XSCF"
From NetSec
m (Changed protection level for "XSCF" ([edit=autoconfirmed] (indefinite) [move=autoconfirmed] (indefinite) [read=autoconfirmed] (indefinite))) |
|
(No difference)
| |
Revision as of 11:10, 10 November 2011
Cross-Site Content Forgery is a vulnerability class that entails malforming the server-side mimetype for a particular resource to make it appear as something else.
Notice: This is by no means original, however the Facebook wiki documents how to do this in detail.
For example, let's say you have an image sitting somewhere that looks innocent. Using Apache directives such as AddType, you can force the content-type of the resource to be processed server-side by any program. The program then seizes control of the resource, and you can then wrap the resource into the functions of the program that is being executed to return output to the client. This is possible because different sites and crawler bots make easily identifiable requests.
|
XSCF Visit the Web Exploitation Portal for complete coverage.
|
