[Full-disclosure] noise about full-width encoding bypass?
3APA3A at SECURITY.NNOV.RU
Tue May 22 11:22:09 BST 2007
Dear Brian Eaton,
--Monday, May 21, 2007, 11:48:09 PM, you wrote to 3APA3A at security.nnov.ru:
BE> On 5/21/07, 3APA3A <3APA3A at security.nnov.ru> wrote:
>> It's not true, because it's quite convertible character. At least for IIS:
>> where test.asp is
BE> This does not work for me for IIS 6 and IE 7. What platform did you test?
Windows 2003 Server Std. Russian + All updates. It may actually depend
on default server language/charset, because text is actually converted
to ANSI charset, not to ASCII. Mine is Windows-1251.
Full-Disclosure is hosted and sponsored by Secunia.