full-disclosure - Re: Internet Explorer URL parsing vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.BSO.4.58.0312111831180.27685@mail.klake.org>
From: jt at klake.org (Jarkko Turkulainen)
Subject: Re: Internet Explorer URL parsing vulnerability

> https://paypal.com  Although I did notice that the <button> seems to be a
> requirement for this vulnerability to work, as using a plain hyperlink
> <a href> fails for me.

I managed it to get working by using raw 0x01 character in url:

<a href='http://www.microsoft.com 0x01 @other_site>

Of course, you must use hex editor to insert the 0x01. Some other
interesting effects can be achieved with:

<a href='http://www.microsoft.com 0x09 0x09 0x09 0x09 0x09 0x09 0x01 0x01
.. many more 0x01's .. 0x01 @other_site


Regards,

--
Jarkko Turkulainen <jt@...ke.org>