Re: [hybi] Handshake was: The WebSocket protocol issues.

[Scott Ferguson <[e-mail]>]

Adam Barth wrote:
> On Mon, Oct 11, 2010 at 9:56 AM, Scott Ferguson <[e-mail]> wrote:
>   
>> You didn't address point #6, the open DELETE.
>>
>> The target is pre-compromised because it has an open DELETE (point #6) and
>> the target is pre-compromised because it's on the same machine as the
>> attacker (point #1).
>>
>> You're requiring a pre-compromised target to make this attack work.
>>     
>
> I'm not sure what pre-compromised means.  I'm not sure that I'd run my
> servers in this configuration, but that doesn't mean lots of other
> people don't.
>   

1. Your target has an open vulnerability ("DELETE") to non-browser clients
2. Your attacker is running an arbitrary program on the same machine as 
the target.
3. Your attacker has control over the target's web server.

That target server is already under the control of the attacker. Adding 
a browser attack to that scenario is superfluous.

-- Scott