Re: [hybi] Handshake was: The WebSocket protocol issues.

[Adam Barth <[e-mail]>]

On Fri, Oct 8, 2010 at 3:04 PM, Scott Ferguson <[e-mail]> wrote:
> Scott Ferguson wrote:
>> Adam Barth wrote:
>>> Consider, for example, a virtual hosting environment in which the
>>> attacker can place PHP scripts on the server....  Now, the attacker can
>>> complete the WebSocket handshake
>>> because the PHP script can compute the HMAC and send the appropriate
>>> response header.
>>
>> Proposed attack: Attack server S with the help of DNS (or hosted HTTP
>> server.)
>>
>> You need to demonstrate a sequence of connections to make that attack work
>> (without using a WebServer proxy or time travel). For discussion, I've
>> granted you syntax, but you must still demonstrate your sequence of
>> connections and propagation of the c-nonce and H to complete the attack.
>
> You still need to demonstrate a sequence of connections to make this attack
> work because your attack appears impossible to complete using TCP as
> currently described.
>
> At very minimum, you need to describe how the WebSocket connection from the
> hijacked browser connects to both the HTTP (or DNS) server that computes the
> hash, and to the target server S to complete the attack.

The DNS server is the target server.

Adam