Gaia SID?

Playing around with dumpster dive when I stumbled across this cookie:


gaia55_sid 9ccc8ccc0c742689c7c7c4c1c2cc2cc20ccc02ccccc2ccc

I changed every letter to "c" just incase they can find an account through SID (If thats what this is)

So, is this your SID that some of those GSI functions need?

Lol. It's exactly what the name implies - a session id. Look up PHP sessions if you're confused (though I'm sure they extend it with a database session as well).

Artificial wrote:

Lol. It's exactly what the name implies - a session id. Look up PHP sessions if you're confused (though I'm sure they extend it with a database session as well).

Hurray. Thanks, now i know how to session hijack.

Artificial wrote:

Lol. It's exactly what the name implies - a session id. Look up PHP sessions if you're confused (though I'm sure they extend it with a database session as well).

So could one use XSS to steal this session, and like fluttershy said, session hijack?

PrincessFluttershy wrote:

Hurray. Thanks, now i know how to session hijack.

XD I know right? Now to find out how to grab the session cookie...

Flareboy323 wrote:

So could one use XSS to steal this session, and like fluttershy said, session hijack?



XD I know right? Now to find out how to grab the session cookie...

Social engineering basically the only way. There's a Chat/GSUI link or something that gives you the exact session ID, i dont recall what it is though nor do I actually care about it.

PrincessFluttershy wrote:

Social engineering basically the only way. There's a Chat/GSUI link or something that gives you the exact session ID, i dont recall what it is though nor do I actually care about it.

XSS is the other way. It requires minimal interaction that way and would work on a click of a link rather than practically coercing someone out of it.

Also don't hand out anything. I'm sure he'll be able to find it himself anyway. Not really hard to find.

The Unintelligible wrote:

XSS is the other way. It requires minimal interaction that way and would work on a click of a link rather than practically coercing someone out of it.

Also don't hand out anything. I'm sure he'll be able to find it himself anyway. Not really hard to find.

Question. Instead of trying to find an XSS exploit in Gaia to steal the session with, is it possible to steal the cookie while on another external website? Like, if the user hit "remember me" or something?

Flareboy323 wrote:

Question. Instead of trying to find an XSS exploit in Gaia to steal the session with, is it possible to steal the cookie while on another external website? Like, if the user hit "remember me" or something?

In theory, no.

The Unintelligible wrote:

In theory, no.

That's basic security 101. So unless you find an exploit within the browser itself, or use a 3rd party (i.e. Java) application, then no - it shouldn't be possible.

I found an XSS vulnerability in Gaia a minute ago, but its on the one page you have to be not logged in on to use -.- pisses me off.

Flareboy323 wrote:

I found an XSS vulnerability in Gaia a minute ago, but its on the one page you have to be not logged in on to use -.- pisses me off.

Show me the vulnerability. That's a pretty eerie characteristic for an XSS hole to have. I'm credulous otherwise.

Edit: That's probably actually fairly common since XSS holes generally exist where page forms are. It won't be of much use if that's the case, though.

Flareboy323 wrote:

Question. Instead of trying to find an XSS exploit in Gaia to steal the session with, is it possible to steal the cookie while on another external website? Like, if the user hit "remember me" or something?

No. Your browser isn't retarded enough to send your cookies to external websites, because that would be the most retarded thing for it to do ever.