Bugtraq mailing list archives
Re: Regular Expression Denial of Service
From: hackerwebzine () gmail com
Date: Mon, 28 Sep 2009 07:19:06 -0600
Alex, it isn't a new technique in web-application security. If you queried Google, or did some research on recent (2007) Blackhat talks, you'll probably noticed that this is very well known and understood technique. Even Charles Miller talked about it (on the OSX Safari exploits). So the claim that security researchers are not aware of it, it somewhat misleading. I personally (and many others too) used the same techniques, albeit slightly different for over 8 years when auditing applications. Since you seem to propose a serious "new" research area, i expect you to research it's history first before claiming "new" research, at least I would appreciate it.
Current thread:
- Regular Expression Denial of Service Alex Roichman (Sep 11)
- Re: Regular Expression Denial of Service Gadi Evron (Sep 11)
- Re[2]: Regular Expression Denial of Service Thierry Zoller (Sep 11)
- Re: Regular Expression Denial of Service Gadi Evron (Sep 11)
- Re: Re[2]: Regular Expression Denial of Service Jeffrey Walton (Sep 14)
- Re[2]: Regular Expression Denial of Service Thierry Zoller (Sep 11)
- Re: Regular Expression Denial of Service Pavel Kankovsky (Sep 14)
- Re: Regular Expression Denial of Service Pavel Kankovsky (Sep 14)
- <Possible follow-ups>
- Re: Regular Expression Denial of Service hackerwebzine (Sep 28)
- Re: Regular Expression Denial of Service Gadi Evron (Sep 11)