full-disclosure - Re: Advisory: Attack of the Mongolian space evaders... (and other Medieval XSS vectors)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1d053ef90809170439j7c857311p27e53d7384052853@mail.gmail.com>
Date: Wed, 17 Sep 2008 19:39:35 +0800
From: Log0 <ky.log0@...il.com>
To: chrisweber@...e.com, full-disclosure@...ts.grok.org.uk
Subject: Re: Advisory: Attack of the Mongolian space
	evaders... (and other Medieval XSS vectors)

Dear Chris,

Very interesting findings. Except :

U+2002 to U+200A
U+205F
U+3000
U+180E Mongolian Vowel Separator
U+1680 Ogham Space Mark

I found that unicode characters below also plagued Opera 9.51 .

U+00A0
U+180F
U+2000
U+2001
U+2028
U+2029
U+202F
U+205F

Got to dig out what is behind the scenes to why it happens. You suggested
interesting tips to me about the character properties. Thank you for
sharing!

For those who are interested, the comments contains more details :

http://lookout.net/2008/08/26/advisory-attack-of-the-mongolian-space-evaders-and-other-medieval-xss-vectors/
http://log0.wordpress.com/2008/09/16/interesting-xss-in-opera-951/

-- 
Best Regards
Log0

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/