**disclaimer: I'm not asking how to hack hotmail. I'm just wanting to start some creative duscussions...
I just got done reading the most recent "how to hack hotmail" post and found it amusing. I then looked back at some of the other posts to see what the big deal was. I found it very interesting everyone was quick to flame, and no one was sent away with any useful "hacking" information. Some of the replies I saw were:
1. Keylogger - Not gonna work unless you have physical access to the host. Lame solution anyway. Not the stealthiest way to do something.
2. Social Eng - This works for almost any password hack, and I guess this would work. Not a real technical solution.
3. Trojan - What are people thinking?
Anyway, the thing that was never brought up was cross site scripting. You don't have have to give line for line details on how to do it. In fact, I'm not even sure it would work for hotmail. I just thought that would be a good attention grabber to discuss it and in theory if it would work.
For those that don't know, a cross site scripting vulnerability is a vulnerabilty that allows "bad guys" with a malicious web site possibly access to the cookies on your machine.
So here's the scenario: You are evil hacker child and wanna get the guy who just looked at you the wrong way. You craft a special web site just for him The web site will contain a few basic scripts (this is the part you have to research to learn a bit). You send him an email with the "bad" website. Once he clicks on it and runs your script, viola, he is now sending you whatever you want (user provided info, cookies, ect). In theory this sounds like this would work for hotmail. You might say well, hotmail is pretty slick, they encrypt thier cookies. Thats ok. You don't have to decrypt it, just cut and paste into the browser and that should do it.
Anyway. This is a pretty sloppily written example (my own random ideas). The idea was to get some new discussion going on this site (for the people new to security and vulnerabilities). I don't have any desire to "hack" hotmail so I have no idea if this would work...but in theory it sounds pretty good.
