Re: [hybi] Handshake was: The WebSocket protocol issues.

[Scott Ferguson <[e-mail]>]

Scott Ferguson wrote:
> Adam Barth wrote:
>> Consider, for example, a virtual hosting environment in which the
>> attacker can place PHP scripts on the server....  Now, the attacker 
>> can complete the WebSocket handshake
>> because the PHP script can compute the HMAC and send the appropriate
>> response header.
>
> Proposed attack: Attack server S with the help of DNS (or hosted HTTP 
> server.)
>
> You need to demonstrate a sequence of connections to make that attack 
> work (without using a WebServer proxy or time travel). For discussion, 
> I've granted you syntax, but you must still demonstrate your sequence 
> of connections and propagation of the c-nonce and H to complete the 
> attack.


You still need to demonstrate a sequence of connections to make this 
attack work because your attack appears impossible to complete using TCP 
as currently described.

At very minimum, you need to describe how the WebSocket connection from 
the hijacked browser connects to both the HTTP (or DNS) server that 
computes the hash, and to the target server S to complete the attack.

-- Scott