Session spoofing? Is it like a host star?

By cowhide total

Experiment with a Session.

Local PHP Version 5.2.3 & apache_2.2.4
Remote Server Environment PHP Version 4.4.0 & Linux Apache/2.0.54 (Unix)
IIS not tested
Test Domain Name: www.netpk.org & www.i0day.cn

First write two PHP scripts Session. php ifsession. php

The session. php code is as follows:

<? Php
Session_start ();

$ _ SESSION [NETPK] = netpk;

Echo $ _ SESSION [NETPK]:. $ _ SESSION [NETPK]. "<br/> ";

Echo <br/> <a href = "ifsession. php"> verify the SESSION </a>;

?>

The ifsession. php code is as follows:

<? Php
Session_start ();

If ($ _ SESSION [NETPK]! = Netpk)
{
Echo session error !!;
} Else
{
Echo Session OK !!;
}
Echo <br/> $ _ SESSION [NETPK]:. $ _ SESSION [NETPK]. "<br/> ";
?>
<A href = "session. php"> return </a>

The local test graph will not be available. It is the same as the remote server result.

The same two scripts are uploaded
Under the root directories www.netpk.org and www.i0day.cn

First http://www.i0day.cn/session.php

SESSION set successfully
Verify it at http://www.i0day.cn/ifsession.php.

OK .. the SESSION value is output successfully.

So here I http://www.netpk.org/ifsession.php. Is it true that I can also successfully verify the output sessionvalue?

ERROR...
Echo session is empty...

Same server ..

 

The practice is over ....
Is it like a host star?