Re: [hybi] Handshake was: The WebSocket protocol issues.

[Bjoern Hoehrmann <[e-mail]>]

* Scott Ferguson wrote:
>So the attacker has a PHP script running on the same physical machine as 
>the target site, on the same VM guest as the target, and using the same 
>shared web server as the target, and has decided that a cross protocol 
>attack is the appropriate vector against a target on the same machine as 
>his PHP script.

In the scenario the browser thinks it is talking Websocket while the
server thinks the browser is talking HTTP, so basically

  +----------------+                    +------------------+
  | User's browser | -- "Websocket" +-- | attacker.example |
  +----------------+                |   +------------------+
                                  HTTP
                                    |   +------------------+
                                    +-- | target.example   |
                                        +------------------+

How attacker.example and target.example are organized is up to the
web server, it could just be some kind of firewall where the two sites
are actually hosted on physically separate machines behind it and they
may be unable to talk to each other. I do think this is something that
the Websocket protocol needs to address.
-- 
Björn Höhrmann · mailto:[e-mail] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: [phone] · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/