Today an interesting advisory about some vulnerabilities affecting Orkut - the famous social networking website, owned by Google.
There are several cases like -Sometimes the application may lock out the user to the main page when an operation fails, asking the user to login again, but failing to logout the user while doing it. This could confuse the users into thinking that they logged out.
And Now a hacker can use this stage for hacking the users account.At this stage the "orkut_state" cookie can still be used to login successfully, even if the user logged out. This is probably due to a failure to mark the session as expired on the server side.
How to?-A Technical Description(Never use this info to hack any others  account)
On successful Orkut login, the following cookies are set:-
1. Domain: .www.orkut.com Cookie: orkut_state
2. Domain: .google.com Cookie: SID
3. Domain: www.google.com Cookie: LSID

Do you like this article? Share It!