full-disclosure - Re: noise about full-width encoding bypass?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <993257611.20070522142209@SECURITY.NNOV.RU>
Date: Tue, 22 May 2007 14:22:09 +0400
From: 3APA3A <3APA3A@...URITY.NNOV.RU>
To: "Brian Eaton" <eaton.lists@...il.com>
Cc: Full-Disclosure <full-disclosure@...ts.grok.org.uk>,
	Web Security <websecurity@...appsec.org>
Subject: Re: noise about full-width encoding bypass?

Dear Brian Eaton,

--Monday, May 21, 2007, 11:48:09 PM, you wrote to 3APA3A@...urity.nnov.ru:

BE> On 5/21/07, 3APA3A <3APA3A@...urity.nnov.ru> wrote:
>> It's not true, because it's quite convertible character. At least for IIS:
>>
>> http://example.com/test.asp?q=%uFF1Cscript>alert("Hello")</script>
>>
>> where test.asp is
>>
>> <%=Request.QueryString("q")%>
>>
>> launches javascript.

BE> This does not work for me for IIS 6 and IE 7.  What platform did you test?

Windows  2003  Server Std. Russian + All updates. It may actually depend
on  default  server language/charset, because text is actually converted
to ANSI charset, not to ASCII. Mine is Windows-1251.

BE> Regards,
BE> Brian

-- 
~/ZARAZA http://securityvulns.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/