RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?
| From: | Ed Lazor | Date: | Mon, 16 Aug 2004 19:09:48 +0000 |
| Subject: | RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-193995@lists.php.net to get a copy of this message | ||
> -----Original Message-----
> The best information would be if you can capture the exact HTTP
> transactions involved. For example, using something like ethereal, capture
> the request and response for Mozilla, and then do the same for IE 6.01
> SP1.
>
> Short of that, you could create a URL specifically made for testing this.
> You can create a PHP file called csrf.php and another called csrf.png.
> Make .png files be interepreted as PHP (just for the purposes of this
> test), and then you can log a lot of useful information in your test
> scripts.
Wouldn't it work to just make the script spit out a mime type header and a
small (1x1) image when it's done to satisfy the browser's mime type
requirements?
-Ed