Session hijacking attack

How it was found

Hi you have Session hijacking attack https://www.owasp.org/index.php/Session_hijacking_attack

Yes, you use HttpOnly cookie , but in older browsers bypass such restrictions exist , that does not prevent in theory find this in the future . As you update the site on a daily basis and it is possible to find when the XSS

In the latter open report, it was shown that after HEAD method could not have been forwarded to https: // that traffic would sniff, for example via a router. Of course this is all in theory. But you can get rid of it at all, than to wait for what is possible through any authorization cookies. For example to make a one-time snap to the ip and browser.

I test on your friend, and no binding was not allowing me to log into his login.

Thank you, haxta4ok00

PSS Recently, I wrote in a support about a bug , but it fixed a while I tried to learn about it and eventually left with nothing . So I ask you if you do not think it Bug do not close a N / A and close the information. Sry bad speak eng.