RE: Extended ASCII characters used for injection
"Onken, Skyler" <[email protected]>
| Newsgroups | gmane.comp.security.web-applications |
|---|---|
| Message-ID | <A3791427C147CE4A95EE4BA87FEB88C403C250@CH1PRD0104MB026.prod.exchangelabs.com> |
Im not aware of any injection attacks directly. In the past I have been able to force information disclosure via 500 error pages (file structure, other applications used, etc) by submitting sequences of characters like those you showed. Skyler Onken CEH, ECSA, Security+ http://securityreliks.securegossip.com ________________________________________ From: [email protected] [[email protected]] on behalf of Nibbler [[email protected]] Sent: Tuesday, October 19, 2010 7:06 AM To: [email protected] Subject: Extended ASCII characters used for injection Hi list, I have a web app and I want to block special characters in URL on the web server. Do you know if there is a risk of injection (XSS...) with extended ASCII char (%7f-%ff)? Is there any reason to block these characters? Thanks Regards, Nib This list is sponsored by Cenzic -------------------------------------- Let Us Hack You. Before Hackers Do! It's Finally Here - The Cenzic Website HealthCheck. FREE. Request Yours Now! http://www.cenzic.com/2009HClaunch_Securityfocus -------------------------------------- This list is sponsored by Cenzic -------------------------------------- Let Us Hack You. Before Hackers Do! It's Finally Here - The Cenzic Website HealthCheck. FREE. Request Yours Now! http://www.cenzic.com/2009HClaunch_Securityfocus --------------------------------------