Update 2016/02: We were asked by a lot if this still works. Shortly after our disclosure, this issue has been patched. ------ The Background - The Past Gaining access to HttpOnly cookie was first attempted by means of XST, Cross Site Tracing vulnerability. Soon after the popularity of XST, the TRACE method has been disabled by most web servers. Later, browsers' implementation of XMLHttpRequest also blocked "TRACE" method (i.e. xmlhttp.open('TRACE', url, true) ]. Later, a flawed implementation in Firefox's XMLHttpRequest which can be used to access set-cookie response header was fixed. JS Debugger pointing out "TRACE" method as invalid arugment JS Debugger pointing out "TRACE" method as illegal value A Sla.ckers.org forum member, LeverOne, posted ways to access HttpOnly cookie through the use of Java API and applet. I reproduced his techniques. When the first method was tried, the Java Runtime did no
If you look at KingRoot web site ( https://kingroot.net ), you might accidentally assume that it can root any Android devices. KingRoot mobile app and desktop app will attempt to root any devices you aim at. If you want to own and buy rootable devices by checking KingRoot supported devices, it is not recommended. The most viable route for nearly guaranteed rootabiliy is to use a list of devices that TWRP supports. Refer to using https://twrp.me/Devices/ The reason for sharing this post is if you search rootablily for a particular device, there will be lots of confusing posts from individuals web blogs and forums. We feel rooting Android should be as simple as rooting iDevices.