Cross-site tracing (XST)

Practice



In web security, cross-site tracing (abbreviated "XST") is a network security vulnerability that exploits the HTTP TRACE method.

XST scenarios use ActiveX , Flash , or any other controls that allow an HTTP TRACE request to be executed. The HTTP TRACE response includes all HTTP headers , including authentication data and the contents of HTTP cookies , which then become accessible to the script. Combined with cross-domain access flaws in web browsers , the exploit can harvest cached credentials from any website, including those that use SSL .

Comments

To leave a comment

If you have any suggestion, idea, thanks or comment, feel free to write. We really value feedback and are glad to hear your opinion.
To reply

Lectures and tutorial on "information security - Cryptography and Cryptanalysis. Steganography. Information protection"

Terms: information security - Cryptography and Cryptanalysis. Steganography. Information protection

Digital fingerprint of the device
Online tests with answers and diagrams on software security
Authentication and authorization in information technology
Security testing: SAST, WAF, DAST, IAST, and RASP
Bogon filtering of IP addresses
Types of web API, SPA, and JWT vulnerabilities in 2022
Cache poisoning
Cross-site request forgery (CSRF)
XSS (cross-site scripting) — its essence and methods of protection
Cross-site tracing (XST)
Cross-server attack (XSA)
CURL — a tool that can be used to force parameters into a web request
Direct Static Code Injection
File inclusion
Full path disclosure (FPD)
HTTP request smuggling
HTTP response splitting
LDAP injection
Local file inclusion
Pharming — what is pharming? Preventing pharming
Phishing — an attempt to obtain confidential information
The poison null byte
Directory traversal attack
File inclusion
Server-side includes (SSI)
Session fixation
Session hijacking
SQL injection: methods of protection, static analysis
The security model of web applications
Honeypot — a lure for intruders
Integrity control of data or resources of a computer system
Message authentication (Message Authentication Code, MAC)
Creating a self-signed trusted certificate for development — a ready-made script
Symmetric cryptosystems
Universally unique identifier (UUID)