I think you'll find that it was my point as well :) Sidejacking isnt a vulnerability. It's the end result after an actual vulnerability has been exploited. I.e. crappy session management, not setting the secure flag, poor use of HTTPS, SSLv2/cipher reuse+weak ciphers+crap browser, or whatever moronic thing the developer did to allow the session token to go over the network in the clear in the first place.
Apparently sarcasm is a lost art form. Renski _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
