Re: [Full-disclosure] [WEB SECURITY] Plain Old Webserver - The coolest firefox extension

[ascii <ascii@xxxxxxxxxxxx>]

Billy Hoffman wrote:
> All depends on in the request processing you apply the fix. Its
> possible that URL Decoding hasn't occuried yet, whereby I can bypass
> your filter pretty easily. Not to mention Unicode...

hehehe i was waiting for this : )

remember: this is funsec

the bypass for the filter is in the signature of the same mail

> path = str_replace('../', '', path);
>
> regards,
> Francesco 'ascii' Ongaro
> http://www.ush.it/
>
> ..././..././..././..././
> how can't you love funsec?

cause ..././..././..././..././ becomes ../../../../ since the replace is
applied only once. simple logic trick, no encoding at all

see you,
Francesco 'ascii' Ongaro
http://www.ush.it/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/