Billy Hoffman wrote:
> All depends on in the request processing you apply the fix. Its
> possible that URL Decoding hasn't occuried yet, whereby I can bypass
> your filter pretty easily. Not to mention Unicode...
hehehe i was waiting for this : )
remember: this is funsec
the bypass for the filter is in the signature of the same mail
> path = str_replace('../', '', path);
>
> regards,
> Francesco 'ascii' Ongaro
> http://www.ush.it/
>
> ..././..././..././..././
> how can't you love funsec?
cause ..././..././..././..././ becomes ../../../../ since the replace is
applied only once. simple logic trick, no encoding at all
see you,
Francesco 'ascii' Ongaro
http://www.ush.it/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
