note 37193 deleted from function.setcookie by sniper
| From: | sniper@php.net | Date: | Sat, 22 Nov 2003 02:38:49 +0000 |
| Subject: | note 37193 deleted from function.setcookie by sniper | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-60804@lists.php.net to get a copy of this message | ||
Note Submitter: fabiostt@libero.it
----
Variables in cookies are not safer than variables in query string, we can easily send fake cookies
even without editing a file
<?php
function send_cookie($host,$path){
$dati="" ;
$fp = fsockopen ($host, 80, $errno, $errstr,30);
socket_set_blocking ($fp,1) ;
if (!$fp) {
echo "$errstr ($errno)<br>\n";
}
else{
fputs ($fp, "GET /$path HTTP/1.0\r\nHost: $host\r\n");
fputs($fp,"Cookie:fake1=".urlencode('this is fake').";
fake2=".urlencode('this is fake too').";\r\n\r\n") ;
while (!feof($fp)) {
$dati.= fgets ($fp,2048);
}
}
fclose ($fp);
echo($dati) ;
}
send_cookie("localhost","info.php") ;
?>
This sends a couple of cookies and reads the response