|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
Re: [Full-disclosure] [WEB SECURITY] Plain Old Webserver - The coolest firefox extension
From: ascii (ascii
katamail.com)
Date: Mon Feb 12 2007 - 15:48:37 CST
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Billy Hoffman wrote:
> All depends on in the request processing you apply the fix. Its
> possible that URL Decoding hasn't occuried yet, whereby I can bypass
> your filter pretty easily. Not to mention Unicode...
hehehe i was waiting for this : )
remember: this is funsec
the bypass for the filter is in the signature of the same mail
> path = str_replace('../', '', path);
>
> regards,
> Francesco 'ascii' Ongaro
> http://www.ush.it/
>
> ..././..././..././..././
> how can't you love funsec?
cause ..././..././..././..././ becomes ../../../../ since the replace is
applied only once. simple logic trick, no encoding at all
see you,
Francesco 'ascii' Ongaro
http://www.ush.it/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]