bugtraq - RE: Bypassing of web filters by using ASCII

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 23 Jun 2006 21:23:17 +0200
From: "Amit Klein (AKsecurity)" <aksecurity@...pop.com>
To: bugtraq@...urityfocus.com,
	"James C. Slora Jr." <james.slora@...a.com>
Subject: RE: Bypassing of web filters by using ASCII


On 23 Jun 2006 at 7:55, James C. Slora Jr. wrote:

> Amit Klein wrote Thursday, June 22, 2006 3:47 AM
> 
> > So in order to exploit this in HTML over HTTP, the attacker needs to
> either add/modify the Content-Type response header, or to add/modify the
> META tag in the HTML page.
> 
> There are other ways that might carry a bigger injection threat:
> 
> Style sheet:
> http://msdn.microsoft.com/library/default.asp?url=/workshop/author/dhtml
> /reference/properties/charset_1.asp
> 
> Object property:
> http://msdn.microsoft.com/library/default.asp?url=/workshop/author/dhtml
> /reference/properties/charset.asp
> 
> 
> By extension, it should also work for inline styles.
> 

Good point, thanks. 

But the main point remains the same - you need to somehow already be in control of the HTML 
in the page in order for this to work, so in most cases it can't serve the entry point for 
XSS (because you need some kind of HTML injection in the first place). 

-Amit