Penetration Testing mailing list archives

Re: [PEN-TEST] IIS UNICODE Strings


From: Mike Ahern <mc_ahern () YAHOO COM>
Date: Wed, 1 Nov 2000 10:53:30 -0800

Vitaly Osipov [vos () TELENOR CZ] wrote:
Hmm... I see some *very* strange strings in you
examples below... the second excaped symbol (%pc for
example) is not real escaped hex-code -if it works,
then the problem is not in Unicode at all, but in
something else
----------------------------------

I've just been informed that the reason for so many of
the UNICODE strings is that characters repeat after
the 256th character, and continue to loop as you
progress upwards in numbers. Maybe I'm understanding
or explaining that poorly, but I think you get the
gist. Perhaps this explains some of the other
characters that seem strange, but I don't know.

Still doesn't explain the problem with the patched
system, but I am still looking under some rocks about
that one to figure out what is happening there.

 -mch




__________________________________________________
Do You Yahoo!?
From homework help to love advice, Yahoo! Experts has your answer.
http://experts.yahoo.com/


Current thread: