RE: Bypassing of web filters by using ASCII
On 23 Jun 2006 at 7:55, James C. Slora Jr. wrote:
> Amit Klein wrote Thursday, June 22, 2006 3:47 AM
>
> > So in order to exploit this in HTML over HTTP, the attacker needs to
> either add/modify the Content-Type response header, or to add/modify the
> META tag in the HTML page.
>
> There are other ways that might carry a bigger injection threat:
>
> Style sheet:
> http://msdn.microsoft.com/library/default.asp?url=/workshop/author/dhtml
> /reference/properties/charset_1.asp
>
> Object property:
> http://msdn.microsoft.com/library/default.asp?url=/workshop/author/dhtml
> /reference/properties/charset.asp
>
>
> By extension, it should also work for inline styles.
>
Good point, thanks.
But the main point remains the same - you need to somehow already be in control
of the HTML
in the page in order for this to work, so in most cases it can't serve the
entry point for
XSS (because you need some kind of HTML injection in the first place).
-Amit