Full Disclosure mailing list archives
Re: [WEB SECURITY] Re: noise about full-width encoding bypass?
From: ascii <ascii () katamail com>
Date: Tue, 22 May 2007 05:00:37 +0200
Brian Eaton wrote:
(Cracking up that somebody going by the handle ascii is commenting on character encoding issues. =)
hehe funsec apart, Brian, i can confirm you that the 3APA3A poc works as expected. i really don't know what benefits can stem from defending asp (or any other language) i just installed a (genuine) vanilla windows xp ita plus iss and asp to replicate the poc on a machine different from the previous one and it worked too for convenience here's the screenshots and the video http://www.ush.it/team/ascii/hack-iis_asp_utf/xss1.png http://www.ush.it/team/ascii/hack-iis_asp_utf/xss2.png http://www.ush.it/team/ascii/hack-iis_asp_utf/xss4.png http://www.ush.it/team/ascii/hack-iis_asp_utf/xss5.png http://www.ush.it/team/ascii/hack-iis_asp_utf/xss6.png http://www.filefactory.com/file/c40485/ (fast one) http://www.ush.it/team/ascii/hack-iis_asp_utf/brian_video.avi (slow) the tested poc is the unmodified 3APA3A ones --8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<-- <%=Request.QueryString("q")%> <pre> <h2>3APA3A poc</h2> http://example.com/test.asp?q=%uFF1Cscript>alert("Hello")</script> where test.asp is < %=Request.QueryString("q")% > launches javascript </pre> --8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<-- my previous writing was based on a simple empirical test, i took the above and converted to php and jsp (eg: <?php echo $_GET['q']; ?>) and it didn't worked the over php poc is pretty different and reminded me this other poc http://shiflett.org/blog/2005/dec/google-xss-example --8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<-- <?php header('Content-Type: text/html; charset=UTF-7'); $string = "<script>alert('XSS');</script>"; $string = mb_convert_encoding($string, 'UTF-7'); echo htmlentities($string); ?> --8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<-- eg. it uses specific functions to demonstrate a vulnerability and is obviously different from <?php echo $_GET['q']; ?> and to clarify i'm not saying that this is anyhow related with http://www.gamasec.net/english/gs07-01.html as for the use of charset encoding issues best regards, Francesco `ascii` Ongaro http://www.ush.it/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: noise about full-width encoding bypass?, (continued)
- Re: noise about full-width encoding bypass? 3APA3A (May 21)
- Re: noise about full-width encoding bypass? Brian Eaton (May 21)
- Re: noise about full-width encoding bypass? 3APA3A (May 22)
- Re: noise about full-width encoding bypass? Brian Eaton (May 21)
- Re: noise about full-width encoding bypass? Brian Eaton (May 21)
- Re: noise about full-width encoding bypass? ascii (May 21)
- Re: noise about full-width encoding bypass? Brian Eaton (May 21)
- Re: noise about full-width encoding bypass? Steven Adair (May 21)
- Re: noise about full-width encoding bypass? Valdis . Kletnieks (May 21)
- Re: noise about full-width encoding bypass? 3APA3A (May 22)
- Re: noise about full-width encoding bypass? ascii (May 21)
- Re: [WEB SECURITY] Re: noise about full-width encoding bypass? Chris Weber (May 21)
- Re: [WEB SECURITY] Re: noise about full-width encoding bypass? ascii (May 21)
- Re: noise about full-width encoding bypass? 3APA3A (May 21)
- Re: [WEB SECURITY] Re: noise about full-width encoding bypass? Brian Eaton (May 22)
- Re: [WEB SECURITY] Re: noise about full-width encoding bypass? Arian J. Evans (May 22)
- Re: [WEB SECURITY] noise about full-width encoding bypass? Arian J. Evans (May 21)
- Re: [WEB SECURITY] noise about full-width encoding bypass? Arian J. Evans (May 22)
- Re: [WEB SECURITY] noise about full-width encoding bypass? Amit Klein (May 22)
- Re: [WEB SECURITY] noise about full-width encoding bypass? Amit Klein (May 23)
- Re: [WEB SECURITY] noise about full-width encoding bypass? Arian J. Evans (May 23)