full-disclosure - Re: [WEB SECURITY] Re: noise about full-width encoding bypass?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 22 May 2007 05:00:37 +0200
From: ascii <ascii@...amail.com>
To: eaton.lists@...il.com
Cc: full-disclosure@...ts.grok.org.uk, 3APA3A@...URITY.NNOV.RU,
	websecurity@...appsec.org
Subject: Re: [WEB SECURITY] Re: noise about full-width
 encoding bypass?

Brian Eaton wrote:
> (Cracking up that somebody going by the handle ascii is commenting on
> character encoding issues. =)

hehe funsec apart, Brian, i can confirm you that the 3APA3A poc works as
expected. i really don't know what benefits can stem from defending asp
(or any other language)

i just installed a (genuine) vanilla windows xp ita plus iss and asp to
replicate the poc on a machine different from the previous one and it
worked too

for convenience here's the screenshots and the video

http://www.ush.it/team/ascii/hack-iis_asp_utf/xss1.png
http://www.ush.it/team/ascii/hack-iis_asp_utf/xss2.png
http://www.ush.it/team/ascii/hack-iis_asp_utf/xss4.png
http://www.ush.it/team/ascii/hack-iis_asp_utf/xss5.png
http://www.ush.it/team/ascii/hack-iis_asp_utf/xss6.png

http://www.filefactory.com/file/c40485/ (fast one)
http://www.ush.it/team/ascii/hack-iis_asp_utf/brian_video.avi (slow)

the tested poc is the unmodified 3APA3A ones

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

<%=Request.QueryString("q")%>
<pre>
<h2>3APA3A poc</h2>
http://example.com/test.asp?q=%uFF1Cscript>alert("Hello")</script>
where test.asp is
< %=Request.QueryString("q")% >
launches javascript
</pre>

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

my previous writing was based on a simple empirical test, i took the
above and converted to php and jsp (eg: <?php echo $_GET['q']; ?>) and
it didn't worked

the over php poc is pretty different and reminded me this other poc
http://shiflett.org/blog/2005/dec/google-xss-example

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

<?php
 header('Content-Type: text/html; charset=UTF-7');
 $string = "<script>alert('XSS');</script>";
 $string = mb_convert_encoding($string, 'UTF-7');
 echo htmlentities($string);
?>

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

eg. it uses specific functions to demonstrate a vulnerability and is
obviously different from <?php echo $_GET['q']; ?>

and to clarify i'm not saying that this is anyhow related with
http://www.gamasec.net/english/gs07-01.html as for the use of charset
encoding issues

best regards,
Francesco `ascii` Ongaro
http://www.ush.it/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/