bugtraq - RE: Bypassing of web filters by using ASCII

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0606231510050.27232@fingers.shocking.com>
Date: Fri, 23 Jun 2006 15:12:27 -0700 (PDT)
From: RSnake <rsnake@...cking.com>
To: "James C. Slora Jr." <james.slora@...a.com>
Cc: bugtraq@...urityfocus.com
Subject: RE: Bypassing of web filters by using ASCII

 	Both of those would work in the case where the charset has
already been set by the server.  The problem is that most servers set a
charset by default.  The other bigger problem is that both of those (and
the META one) require that you inject HTML into the page to get it to
work.  If you can inject a style tag into a page you can embed XSS
See http://ha.ckers.org/xss.html

On Fri, 23 Jun 2006, James C. Slora Jr. wrote:

> Amit Klein wrote Thursday, June 22, 2006 3:47 AM
>
>> So in order to exploit this in HTML over HTTP, the attacker needs to
> either add/modify the Content-Type response header, or to add/modify the
> META tag in the HTML page.
>
> There are other ways that might carry a bigger injection threat:
>
> Style sheet:
> http://msdn.microsoft.com/library/default.asp?url=/workshop/author/dhtml
> /reference/properties/charset_1.asp
>
> Object property:
> http://msdn.microsoft.com/library/default.asp?url=/workshop/author/dhtml
> /reference/properties/charset.asp
>
>
> By extension, it should also work for inline styles.
>
>
>
>

-RSnake
http://ha.ckers.org/
http://ha.ckers.org/blog/feed/