Dear Brian Eaton, --Monday, May 21, 2007, 11:48:09 PM, you wrote to [EMAIL PROTECTED]:
BE> On 5/21/07, 3APA3A <[EMAIL PROTECTED]> wrote: >> It's not true, because it's quite convertible character. At least for IIS: >> >> http://example.com/test.asp?q=%uFF1Cscript>alert("Hello")</script> >> >> where test.asp is >> >> <%=Request.QueryString("q")%> >> >> launches javascript. BE> This does not work for me for IIS 6 and IE 7. What platform did you test? Windows 2003 Server Std. Russian + All updates. It may actually depend on default server language/charset, because text is actually converted to ANSI charset, not to ASCII. Mine is Windows-1251. BE> Regards, BE> Brian -- ~/ZARAZA http://securityvulns.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
