Wireshark-dev: [Wireshark-dev] [Full-disclosure] Re: Bypassing of web filters by using ASCII (f
From: Joerg Mayer <jmayer@xxxxxxxxx>
Date: Thu, 22 Jun 2006 17:42:57 +0200
The topic is about how ASCII characters with bit 8 set are handled. I haven't access to my sources right now, so I can't verfiy this. If this is the case, the right thing to do would be do display any characters > 0x7F as "undisplayable". Ciao Joerg ----- Forwarded message from imipak <imipak@xxxxxxxxx> ----- Delivered-To: jmayer@xxxxxxxxxxxxxxxxxxxxxxxxx Delivered-To: full-disclosure@xxxxxxxxxxxxxxxxx Date: Thu, 22 Jun 2006 10:31:29 +0100 From: imipak <imipak@xxxxxxxxx> To: full-disclosure@xxxxxxxxxxxxxxxxx, k.huwig@xxxxxxxxx Cc: Subject: [Full-disclosure] Re: Bypassing of web filters by using ASCII Errors-To: full-disclosure-bounces@xxxxxxxxxxxxxxxxx Hi, >2. affected software > >Only the InternetExplorer displays ASCII encoded web pages as 7 bit. We >checked several hardware router and antivirus solutions, all of which >failed to detect malicious JavaScript in manipulated web pages. Ethereal (I can't bring myself to call it 'wireshark' yet) seems to be vulnerable to the same problem. This is from the 'follow TCP stream' dialog, showing the request and response for the PoC page: GET /ASCII HTTP/1.1 Host: www.iku-ag.de User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.4) Gecko/20060504 Firefox/1.5.0.4 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 Accept-Language: en,en-us;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Cache-Control: max-age=0 HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Type: text/html;charset=US-ASCII Transfer-Encoding: chunked Date: Thu, 22 Jun 2006 09:21:54 GMT c3 <html><head><title>ASCII Test</title></head><body><div style="border: 2px solid; padding: 5px; margin-left: 10px; background-color: #ffffc0;">.......................................</body></html> 0 Hmmm, I just noticed Firefox's Accept-Charset header doesn't include ASCII. Does the HTTP spec say that ASCII is the default charset? /i _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ----- End forwarded message ----- -- Joerg Mayer <jmayer@xxxxxxxxx> We are stuck with technology when what we really want is just stuff that works. Some say that should read Microsoft instead of technology.
- Prev by Date: [Wireshark-dev] Adding a dissector for IuB FP
- Next by Date: Re: [Wireshark-dev] Disectors & conversations
- Previous by thread: [Wireshark-dev] Adding a dissector for IuB FP
- Next by thread: Re: [Wireshark-dev] [Ethereal-dev] Dissector SSL : patch + bugs
- Index(es):
- Get Wireshark
- Download
- Code of Conduct