Full Disclosure mailing list archives
Re: [WEB SECURITY] Plain Old Webserver - The coolest firefox extension
From: "Billy Hoffman" <Billy.Hoffman () spidynamics com>
Date: Mon, 12 Feb 2007 15:32:50 -0500
All depends on in the request processing you apply the fix. Its possible that URL Decoding hasn't occuried yet, whereby I can bypass your filter pretty easily. Not to mention Unicode... Billy Hoffman -- Lead Researcher, SPI Labs SPI Dynamics Inc. - http://www.spidynamics.com Phone: 678-781-4800 Direct: 678-781-4845 -----Original Message----- From: ascii [mailto:ascii () katamail com] Sent: Friday, February 09, 2007 7:29 PM To: full-disclosure () lists grok org uk; websecurity () webappsec org Subject: Re: [WEB SECURITY] Plain Old Webserver - The coolest firefox extension pdp (architect) wrote:
hei man, this is not a news :)
hehe, the maintainer should update the changelog with this feature then :-) i suggest this fix for the directory traversal bug path = str_replace('../', '', path); regards, Francesco 'ascii' Ongaro http://www.ush.it/ ..././..././..././..././ how can't you love funsec? ------------------------------------------------------------------------ ---- Join us on IRC: irc.freenode.net #webappsec The Web Security Mailing List: http://www.webappsec.org/lists/websecurity/ The Web Security Mailing List Archives: http://www.webappsec.org/lists/websecurity/archive/ http://www.webappsec.org/rss/websecurity.rss [RSS Feed] _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Plain Old Webserver - The coolest firefox extension pdp (architect) (Feb 09)
- Re: [WEB SECURITY] Plain Old Webserver - The coolest firefox extension Stefano Di Paola (Feb 09)
- Re: [WEB SECURITY] Plain Old Webserver - The coolest firefox extension pdp (architect) (Feb 10)
- Re: [WEB SECURITY] Plain Old Webserver - The coolest firefox extension ascii (Feb 09)
- Re: [WEB SECURITY] Plain Old Webserver - The coolest firefox extension Billy Hoffman (Feb 12)
- Re: [WEB SECURITY] Plain Old Webserver - The coolest firefox extension ascii (Feb 12)
- Re: [WEB SECURITY] Plain Old Webserver - The coolest firefox extension Giorgio Fedon (Feb 12)
- Re: [WEB SECURITY] Plain Old Webserver - The coolest firefox extension pdp (architect) (Feb 10)
- Re: [WEB SECURITY] Plain Old Webserver - The coolest firefox extension Stefano Di Paola (Feb 09)
- Re: [WEB SECURITY] Plain Old Webserver - The coolest firefox extension Matthew Flaschen (Feb 23)