Word Press: Md5 hash in Cookie

March 15, 2007 What Did I Learn Today | sid @ 2:54 pm

I realised word press uses a static cookie, even when u have not enabled remember-me option. This static value holds the md5 of your password (md5(md5 of password)), which remains static. Thus an xss exploit in wordpress could be really handy as the cookie remains the same unless the password for the user is changed.

2 Comments »

  1. […] hash of password of all users including admin user. Before you run mdcrack on this hash, read my previous post on wordpress cookies as this will save your time. Once you have the admin user hash needless to say […]

    Pingback by » Wordpress 2.1.2 xmlrpc Security Issues » www.notsosecure.com :: April 3, 2007 @ 6:38 pm

  2. acaba TÃœRKÄ°SH yok mu ?

    Comment by Türk :: April 8, 2007 @ 10:41 am

RSS feed for comments on this post. TrackBack URI

Leave a comment