elSalmao Alikum
Dear Ahmed, thanks for the nice article, you're mentioning something that already happen to me, it is a simple page with a client-side script which could be XSS as you mentioned, but anyway they kept the session-ID, and then they can get access EVERY TIME to the email "Hotmail" I even challenged the guy to change the account password after I change it, and still he can get access to it somehow and change it again and again !... weird,…

Anyway, in your previous post you mentioned the Session-ID and I was wondering what do you mean by session-ID, do you mean this long query-string sent on the Hotmail pages url, or this is a Session-ID created by the browser itself ?

Because I don't understand what is the relation of any link that could be sent using the MSN itself and when I open the link "click the link direct" it will open-up the associated program of that link "which is IE Internet Explorer", means it will execute the url "shellExecute API" , the browser will "navigate" to the given URL ? what is wrong with that?

Another question,… XSS can give you the access to the information from whatever the DOM of the HTML object or any element maybe, but what is the type of information that would be used to let another user get access to the Hotmail email, ? I don't think it is the url?, if I give you the link of my INBOX once I logged, you will not be able to view the link, unless you pass the authentication first ! ?

Thanks
Jazakum Allahu Khayran
Your friend "Mohamed Shehata "a.k.a "S|M|O|K|E"