full-disclosure-uk May 2007 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: Re: [Full-disclosure] noise about full-width

Re: [Full-disclosure] noise about full-width encoding bypass?

From: Brian Eaton <eaton.lists_at_nospam>
Date: Mon May 21 2007 - 19:48:09 GMT
To: 3APA3A <3APA3A@security.nnov.ru>


On 5/21/07, 3APA3A <3APA3A@security.nnov.ru> wrote:
> It's not true, because it's quite convertible character. At least for IIS:
>
> http://example.com/test.asp?q=%uFF1Cscript>alert("Hello")</script>
>
> where test.asp is
>
> <%=Request.QueryString("q")%>
>
> launches javascript.

This does not work for me for IIS 6 and IE 7. What platform did you test?

Regards,
Brian



Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/