full-disclosure - Re: Bypassing of web filters by using ASCII

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <a3a7d6660606220231u67717cb1qff8e1102e3047e25@mail.gmail.com>
Date: Thu Jun 22 14:24:36 2006
From: imipak at gmail.com (imipak)
Subject: Re: Bypassing of web filters by using ASCII

Hi,

> 2. affected software
>
> Only the InternetExplorer displays ASCII encoded web pages as 7 bit. We
> checked several hardware router and antivirus solutions, all of which
> failed to detect malicious JavaScript in manipulated web pages.


Ethereal (I can't bring myself to call it 'wireshark' yet) seems to be
vulnerable to the same problem. This is from the 'follow TCP stream'
dialog, showing the request and response for the PoC page:


GET /ASCII HTTP/1.1

Host: www.iku-ag.de

User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.4)
Gecko/20060504 Firefox/1.5.0.4

Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5

Accept-Language: en,en-us;q=0.5

Accept-Encoding: gzip,deflate

Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7

Keep-Alive: 300

Connection: keep-alive

Cache-Control: max-age=0



HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Content-Type: text/html;charset=US-ASCII

Transfer-Encoding: chunked

Date: Thu, 22 Jun 2006 09:21:54 GMT



c3

<html><head><title>ASCII Test</title></head><body><div style="border:
2px solid; padding: 5px; margin-left: 10px; background-color:
#ffffc0;">.......................................</body></html>

0




Hmmm, I just noticed Firefox's Accept-Charset header doesn't include
ASCII. Does the HTTP spec say that ASCII is the default charset?

/i