Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Full-disclosure] noise about full-width encoding bypass?

from [Brian Eaton] Network Security [Permanent Link]
Subject: Re: [Full-disclosure] noise about full-width encoding bypass?
Date: Mon, 21 May 2007 14:36:59 -0400 
On 5/21/07, Brian Eaton <eaton.lists@gmail.com> wrote:

Has anyone had a look at the full-width unicode encoding trick discussed here?

http://www.kb.cert.org/vuls/id/739224

AFAICT, this technique could be useful for a homograph attack.  I
don't think it's useful for much else.  However, a few vendors have
reacted already, so I may be missing something important.


To summarize what I've heard from various sources: I am missing
something important. =)  Both PHP and ASP.NET will decode these
characters into their ASCII equivalents.  I don't think J2EE apps are
vulnerable, but this is definitely useful for more more than just
homograph attacks.

Thanks to the various people who have tested this out!

Regards,
Brian

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  [Full-disclosure] [SECURITY] [DSA 1296-1] New php4 packages fix privilege escalation, Moritz Muehlenhoff
Next by Date:  Re: [Full-disclosure] noise about full-width encoding bypass?, ascii
Previous by Thread:  Re: [Full-disclosure] noise about full-width encoding bypass?, 3APA3A
Next by Thread:  Re: [Full-disclosure] noise about full-width encoding bypass?, ascii
Indexes:  [Date] [Thread] [Top] [All Lists]