Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Re: Apache Multiple Injection Vulnerabilities |
|---|---|
| Date: | Thu, 15 Feb 2007 20:46:35 +0100 |
Yes, that's true, control characters are not in violation of the stated charset "iso-8859-1". Thank you for notice me this. Unfortunately I mispelled "iso-8859-1" as "iso 8859-1" wich is not the same. I'm sorry for this. I'll correct this right now. Sincerely,
Just a quick note: what you demonstrated is that "control characters" are returned in a response whose charset is "iso-8859-1". But your text later states that "ISO 8859-1 encodes ...". Notice the difference: "iso-8859-1" vs. "iso 8859-1" - hyphen vs. space. These are different character sets - iso-8859-1 is a superset of iso 8859-1, adding all those control characters and whatnot. From RFC-1345: &charset ISO_8859-1:1987 &rem source: ECMA registry &alias iso-ir-100 &g1esc x2d41 &g2esc x2e41 &g3esc x2f41 &alias ISO_8859-1 &alias ISO-8859-1 &alias latin1 &alias l1 &alias IBM819 &alias CP819 &code 0 NU SH SX EX ET EQ AK BL BS HT LF VT FF CR SO SI DL D1 D2 D3 D4 NK SY EB CN EM SB EC FS GS RS US SP ! " Nb DO % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ?control
characters are not in violation of the stated charset
At A B C D E F G H I J K L M N O P Q R S T U V W X Y Z <( // )> '> _ '! a b c d e f g h i j k l m n o p q r s t u v w x y z (! !! !) '? DT PA HO BH NH IN NL SA ES HS HJ VS PD PU RI S2 S3 DC P1 P2 TS CC MW SG EG SS GC SC CI ST OC PM AC NS !I Ct Pd Cu Ye BB SE ': Co -a << NO -- Rg '- DG +- 2S 3S '' My PI .M ', 1S -o >> 14 12 34 ?I A! A' A> A? A: AA AE C, E! E' E> E: I! I' I> I: D- N? O! O' O> O? O: *X O/ U! U' U> U: Y' TH ss a! a' a> a? a: aa ae c, e! e' e> e: i! i' i> i: d- n? o! o' o> o? o: -: o/ u! u' u> u: y' th y: So those control characters are not in violation of the stated charset. Thanks, -Amit
-- $>cd /pub $>more beer "I spent a lot of money on booze, birds and fast cars. The rest I just squandered" George Best "¡Triste época la nuestra! Es más fácil desintegrar un átomo que un prejuicio." Albert Einstein "Que dos y dos sean necesariamente cuatro, es una opinión que muchos compartimos. Pero si alguien sinceramente piensa otra cosa, que lo diga. Aquí no nos asombramos de nada." Antonio Machado "La política es el arte de buscar problemas, encontrarlos, hacer un diagnóstico falso y aplicar después los remedios equivocados." Groucho Marx "No permitais que vuestros estudios interfieran en vuestra educación..."
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re: iDefense Security Advisory 02.15.07: Multiple Vendor ClamAV MIME Parsing Directory Traversal Vulnerability, Alan J. Wylie |
|---|---|
| Next by Date: | Drive-by Pharming Threat, Zulfikar Ramzan |
| Previous by Thread: | Re: Apache Multiple Injection Vulnerabilities, Amit Klein |
| Next by Thread: | RE: Apache Multiple Injection Vulnerabilities, Rogier Mulhuijzen |
| Indexes: | [Date] [Thread] [Top] [All Lists] |