full-disclosure - Re: noise about full-width encoding bypass?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 21 May 2007 20:02:40 +0400
From: 3APA3A <3APA3A@...URITY.NNOV.RU>
To: "Brian Eaton" <eaton.lists@...il.com>
Cc: Full-Disclosure <full-disclosure@...ts.grok.org.uk>,
	Web Security <websecurity@...appsec.org>
Subject: Re: noise about full-width encoding bypass?

Dear Brian Eaton,

--Monday, May 21, 2007, 6:22:21 PM, you wrote to websecurity@...appsec.org:

BE> If the SQL engine is processing queries in ASCII or ISO-8859-1, the
BE> conversion from unicode to the code page used by the engine will fail.
BE>  Either the engine will give up on the query, or it might substitute a
BE> question mark (?) for the unconvertible character.

It's not true, because it's quite convertible character. At least for IIS:

http://example.com/test.asp?q=%uFF1Cscript>alert("Hello")</script>

where test.asp is

<%=Request.QueryString("q")%>

launches javascript.

BTW:  It  may be used to bypass keyword based filtering to create, e.g.
porn pages available through any corporate firewall. See

http://securityvulns.ru/files/p.html

-- 
~/ZARAZA http://securityvulns.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/