Stealing session ids with <code>phpinfo()</code> and how to stop it

This site does not allow itself to be embedded. You can still read it on the original site — the toolbar below keeps your place in the directory.

Stealing session ids from phpinfo() output has been a known technique for some time, and is used to bypass the HttpOnly attribute, which prohibits JavaScript from accessing a cookie marked as such (e.g. PHPSESSID ). I just now thought of a solution that allows you to keep your phpinfo() : we'll simply censor the sensitive data, making phpinfo() lose some of its value to the attacker.

Read on michalspacek.com ↗