From: Frank Knobbe (frank@knobbe.us)
Date: Fri Mar 26 2004 - 16:54:26 EST
On Fri, 2004-03-26 at 02:29, Dominick Baier wrote:
> however there is a bug in asp.net 1.1 with null characters :
>
> won't work
> http://foo.bar/search.aspx?term=
>
> will work
> http://foo.bar/search.aspx?term=<%00SCRIPT>alert('Vulnerable')</SCRIPT>
What did I say earlier about not trusting the OS? Perfect example here.
You can't trust anybody but your own code :)
Any idea why Microsoft is filtering for "<SCRIPT>" specifically and not
just "<" and ">"?
Regards,
Frank
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:51 EDT