News for hackers. Stuff that matters.
Re:HTTP Response Splitting Vulnerability on reddit.com by jaysoo on Saturday January 15, 2011 @10:27PM (#2108558)
The goal could be CSRF instead of actually reading the cookies. If there's a SessionID cookie for example, you can use JS to GET/POST the request to the server without needing to know the value of SessioID because the browser will send it as part of the request anyway.

The HTTP Response Splitting vulnerability can have many implications, XSS and CSRF attacks are just some examples.

Re:HTTP Response Splitting Vulnerability on reddit.com by peripitea on Sunday January 16, 2011 @05:15PM (#2110417)
Ah, right. Thanks!