Bugtraq mailing list archives
Re: Bypassing of web filters by using ASCII
From: David Huecking <d.huecking () gmx net>
Date: Sun, 25 Jun 2006 17:42:07 +0200
Am Mittwoch, 21. Juni 2006 15:11 schrieb k.huwig () iku-ag de: [...]
Product : Microsoft InternetExplorer 6
[...]
Of the tested browsers Firefox 1.5, Opera 8.5 and InternetExplorer 6, only the InternetExplorer does this correctly, the others evaluate the bit and display the characters as if they were from the character set ISO-8859-1. Although the behaviour of the InternetExplorer is the correct one, this creates a security risk: the author of a web page can
[...]
http://www.iku-ag.de/ASCII you can find a test page that displays a secret message. IE6 displays the text correctly, Firefox 1.5 and Opera 8.5 display glibberish text. This page only shows that IE6 displays ASCII-text correctly and does not contain any content that a filter should sort out.
[...]
There is no workaround know to us. -- Kurt Huwig iKu Systemhaus AG http://www.iku-ag.de/ Vorstand Am Römerkastell 4 Telefon 0681/96751-0 66121 Saarbrücken Telefax 0681/96751-66 GnuPG 1024D/99DD9468 64B1 0C5B 82BC E16E 8940 EB6D 4C32 F908 99DD 9468
Running MS Internet Explorer 6SP1 (German) with wine under Linux does also display the text like Firefox 1.5 and Konqueror. http://www.iku-ag.de/ascii.cgi.htm is also displayed like in the "native" programs (garbage). ...just my 2 cents, David. -- Eat, sleep and go running, ;-) David Huecking. Encrypted eMail welcome! GnuPG/ PGP-Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216
Current thread:
- Re: Bypassing of web filters by using ASCII, (continued)
- Re: Bypassing of web filters by using ASCII Kurt Huwig (Jun 22)
- Re: Bypassing of web filters by using ASCII Amit Klein (AKsecurity) (Jun 22)
- RE: Bypassing of web filters by using ASCII James C. Slora Jr. (Jun 23)
- RE: Bypassing of web filters by using ASCII Amit Klein (AKsecurity) (Jun 26)
- RE: Bypassing of web filters by using ASCII RSnake (Jun 26)
- Re: Bypassing of web filters by using ASCII Hubert Seiwert (Jun 27)
- RE: Bypassing of web filters by using ASCII James C. Slora Jr. (Jun 26)
- Re: Bypassing of web filters by using ASCII Thor (Hammer of God) (Jun 23)
- Re: Bypassing of web filters by using ASCII Kurt Huwig (Jun 22)
- Re: Bypassing of web filters by using ASCII David Huecking (Jun 26)
- Message not available
- Re: Bypassing of web filters by using ASCII Amit Klein (AKsecurity) (Jun 23)
- Re: Bypassing of web filters by using ASCII Vincent Archer (Jun 26)
- Re: Bypassing of web filters by using ASCII Balazs Attila-Mihaly (Cd-MaN) (Jun 26)