Re: New Web Vulnerability - Cross-Site Tracing (fwd)

Jeremiah Grossman wrote:
 >
> The essential pieces that

So the essential pieces that require "full exploitation as you define" are:

1. script on a page
2. a trace supporting web target

and nothing else?

I was confused by your lead-in of "essential" and the inclusion of "domain-restriction-bypass flaw" with a "not essential" disclaimer.

thanks,

-- 
Gary Flynn
Security Engineer - Technical Services
James Madison University

Please R.U.N.S.A.F.E.
http://www.jmu.edu/computing/runsafe