Cross Site Tracing

Revision as of 07:25, 11 October 2007 by Kcghost (talk | contribs) (XST moved to Cross Site Tracing: I decided it's more proper if the article name isn't an acronym. I'll set up a re-direct for XST)

Jump to: navigation, search
This is an Attack. To view all attacks, please see the Attack Category page.

An XST (Cross-Site Tracing) attack involves the use of XSS and the HTTP TRACE function. HTTP TRACE is a default function in many webservers primarily used for debugging. The client sends an HTTP TRACE with all header information including cookies, and the server simply responds with that same data. If using Javascript or other methods to steal a cookie or other information is disabled through the use of an "httpOnly" cookie or otherwise, an attacker may force the browser to send an HTTP TRACE request and send the server response to another site. "httpOnly" is an extra parameter added to cookies which hides the cookie from the script (supported in most, but not all browsers). For example "javascript:alert(document.cookie)" would not show an httpOnly cookie.

This type of attack can occur when the there is an XSS vulnerability and the server supports HTTP TRACE.

Avoidance and mitigation

  • Disable HTTP Trace on your web server
  • Prevent any XSS on your web site

Examples and References

Related Articles

Related Attacks and Vulnerabilites