full-disclosure - Re: Internet Explorer URL parsing vulnerabi lity

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: jbruce at unitedscience.com (jbruce@...tedscience.com)
Subject: Re: Internet Explorer URL parsing vulnerabi
	 lity

Using internet explorer, you can also put http://whateverhere@...gle.com and
that will take you to google. It only matters what you put after the @ sign.
I noticed that one day while putting in my email address in for hotmail. 

-----Original Message-----
From: William Warren [mailto:hescominsoon@...fles.com] 
Sent: Thursday, December 11, 2003 2:55 PM
To: Jim Race
Cc: LC
Subject: Re: [Full-Disclosure] Re: Internet Explorer URL parsing vulnerabi
lity

mozilla 1.6a

http://www.microsoft.com%01@...shdot.org/
(that is in the address bar) and slashdot comes up in the browser window..

Jim Race wrote:

>> http://petard.freeshell.org/ms-announce.html
>
>
> Mozilla 1.5:
>
> Displays in status bar, as well as takes user to http://www.microsoft.com
>
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5) Gecko/20031007
>
> -jim
>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

-- 
May God Bless you and everything you touch.

My "foundation" verse: 
Isaiah 54:17 No weapon that is formed against thee shall prosper; and every
tongue that shall rise against thee in judgment thou shalt condemn. This is
the heritage of the servants of the LORD, and their righteousness is of me,
saith the LORD.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html