[WEB SECURITY] Re: [Full-disclosure] noise about full-width encoding bypass?

["Brian Eaton" <eaton.lists@xxxxxxxxx>]

On 5/21/07, 3APA3A <3APA3A@xxxxxxxxxxxxxxxx> wrote:
> It's not true, because it's quite convertible character. At least for IIS:
>
> http://example.com/test.asp?q=%uFF1Cscript>alert("Hello")</script>
>
> where test.asp is
>
> <%=Request.QueryString("q")%>
>
> launches javascript.

This does not work for me for IIS 6 and IE 7.  What platform did you test?

Regards,
Brian

----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/

Subscribe via RSS: 
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]