Re: noise about full-width encoding bypass?

[3APA3A <3APA3A () SECURITY NNOV RU>]

Dear Brian Eaton,

--Monday, May 21, 2007, 11:48:09 PM, you wrote to 3APA3A () security nnov ru:

BE> On 5/21/07, 3APA3A <3APA3A () security nnov ru> wrote:
> > It's not true, because it's quite convertible character. At least for IIS:
> >
> > http://example.com/test.asp?q=%uFF1Cscript>alert("Hello")</script>
> >
> > where test.asp is
> >
> > <%=Request.QueryString("q")%>
> >
> > launches javascript.

BE> This does not work for me for IIS 6 and IE 7.  What platform did you test?

Windows  2003  Server Std. Russian + All updates. It may actually depend
on  default  server language/charset, because text is actually converted
to ANSI charset, not to ASCII. Mine is Windows-1251.


BE> Regards,
BE> Brian

-- 
~/ZARAZA http://securityvulns.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/