Re: [hybi] Handshake was: The WebSocket protocol issues.

[Bjoern Hoehrmann <[e-mail]>]

* Scott Ferguson wrote:
>The target is pre-compromised because it has an open DELETE (point #6) 
>and the target is pre-compromised because it's on the same machine as 
>the attacker (point #1).

You are misunderstanding the example trace I gave. The DELETE is sent to
the attacker, not the target. The server 1.2.3.4 needs to think that the
client is still talking HTTP, and if the first thing it sees is "ħ<" or
something like that, it might respond with an error message and close
the connection. "DELETE..." in US-ASCII looks like a Websocket text
frame and like HTTP, so I am using that as an example. If the attacker
manages to create the initial frames such that the web server keeps the
connection open, then he can send pretty much arbitrary HTTP requests to
the target server.
-- 
Björn Höhrmann · mailto:[e-mail] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: [phone] · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/