Posted by pepper.gabriela on 09/22/07 07:09

On 18 Set, 02:58, Jerry Stuckle <jstuck...@attglobal.net> wrote:

>
> And a hacker couldn't register and get a session active? Quite easy.
>



I don't know!
Could an hacker control the value of a specified session variable? I
hope not! :-)
How does the hacker know the name of a session variable and its right
value?

I define:

$_SESSION[$username][$randomValue] = $fixedValue;
How could the hacker infer:
- the name of the user;
- the random number (previously generated and only active when logged
in);
- the fixed value for test;

[Back to original message]