full-disclosure - Re: Internet Explorer URL parsing vulnerabi lity

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Subject: Re: Internet Explorer URL parsing vulnerabi	lity

jbruce@...tedscience.com wrote:

> Using internet explorer, you can also put http://whateverhere@...gle.com
> and that will take you to google. It only matters what you put after the
> @ sign. I noticed that one day while putting in my email address in for
> hotmail. 

And not _just_ in IE.

What you have described is, in fact, more or less the "expected 
behaviour" of a web browser given the input you described and RFC 2396. 
Surely to comment in such a thread you have read the RFC that defines 
the format of URIs:

   ftp://ftp.rfc-editor.org/in-notes/rfc2396.txt

Search for "userinfo".

...

I'll repeat my earlier suggestion that I'm sure it would be greatly 
appreciated all round if only moderately clueful responses were posted 
in this thread...

Regards,

Nick FitzGerald