data: URL madness Hi! Maybe it's not really new but you guys might wanna check that out - I played a little bit with the data:-URL feature supported by FFox, Opera and IE7 (dunno if Safari does too). Does anyone else think that this is weird? http://h4k.in/dataurl Please tell me what you think! Greetings, .mario http://sla.ckers.org/forum/read.php?12,11441,11441#msg-11441 Tue, 18 Jun 2013 17:03:46 -0500 Phorum 5.2.15a http://sla.ckers.org/forum/read.php?12,11441,11493#msg-11493 Re: data: URL madness http://sla.ckers.org/forum/read.php?12,11441,11493#msg-11493 Anonymous User Projects Sat, 12 May 2007 15:44:17 -0500 http://sla.ckers.org/forum/read.php?12,11441,11469#msg-11469 Re: data: URL madness http://sla.ckers.org/forum/read.php?12,11441,11469#msg-11469 Anonymous User Projects Fri, 11 May 2007 09:56:21 -0500 http://sla.ckers.org/forum/read.php?12,11441,11468#msg-11468 Re: data: URL madness http://sla.ckers.org/forum/read.php?12,11441,11468#msg-11468 trev Projects Fri, 11 May 2007 09:49:27 -0500 http://sla.ckers.org/forum/read.php?12,11441,11460#msg-11460 Re: data: URL madness http://sla.ckers.org/forum/read.php?12,11441,11460#msg-11460
@trev: Didn't know the atob / btob issue. It's Gecko-only, right?

@CrYpTiC_MauleR: Yes - I guess so.]]> Anonymous User Projects Fri, 11 May 2007 03:09:39 -0500 http://sla.ckers.org/forum/read.php?12,11441,11451#msg-11451 Re: data: URL madness http://sla.ckers.org/forum/read.php?12,11441,11451#msg-11451 CrYpTiC_MauleR Projects Thu, 10 May 2007 18:12:16 -0500 http://sla.ckers.org/forum/read.php?12,11441,11450#msg-11450 Re: data: URL madness http://sla.ckers.org/forum/read.php?12,11441,11450#msg-11450 
javascript:'%3cscript%3ealert(1);%3c/script%3e'
javascript:'\x3cscript\x3ealert(1);\x3c/script\x3e'
javascript:atob('PHNjcmlwdD5hbGVydCgxKTs8L3NjcmlwdD4=')
javascript:atob('\120HNjcmlwdD5hbGVydCgxKTs8L3NjcmlwdD4=')
]]> trev Projects Thu, 10 May 2007 17:14:14 -0500 http://sla.ckers.org/forum/read.php?12,11441,11446#msg-11446 Re: data: URL madness http://sla.ckers.org/forum/read.php?12,11441,11446#msg-11446
data:text/html;charset=utf-7,+ADwAcwBjAHIAaQBwAHQAPg+-alert(1);history.back()+ADs-</script>

...is called, UTF7 is given but UTF16/BASE64, UTF8 and UTF7 in combination are executed.

It doesn't really create new security holes but coming to filtering it really makes life harder. Any charset normalization (I know) and therefore intrusion detection would fail.

Greetings,
.mario]]> Anonymous User Projects Thu, 10 May 2007 16:34:53 -0500 http://sla.ckers.org/forum/read.php?12,11441,11445#msg-11445 Re: data: URL madness http://sla.ckers.org/forum/read.php?12,11441,11445#msg-11445
Do you think maybe it just not obeying the charset specified.]]> CrYpTiC_MauleR Projects Thu, 10 May 2007 16:27:31 -0500 http://sla.ckers.org/forum/read.php?12,11441,11444#msg-11444 Re: data: URL madness http://sla.ckers.org/forum/read.php?12,11441,11444#msg-11444 Anonymous User Projects Thu, 10 May 2007 16:08:15 -0500 http://sla.ckers.org/forum/read.php?12,11441,11442#msg-11442 Re: data: URL madness http://sla.ckers.org/forum/read.php?12,11441,11442#msg-11442 CrYpTiC_MauleR Projects Thu, 10 May 2007 16:01:09 -0500 http://sla.ckers.org/forum/read.php?12,11441,11441#msg-11441 data: URL madness http://sla.ckers.org/forum/read.php?12,11441,11441#msg-11441
Maybe it's not really new but you guys might wanna check that out - I played a little bit with the data:-URL feature supported by FFox, Opera and IE7 (dunno if Safari does too). Does anyone else think that this is weird?

http://h4k.in/dataurl

Please tell me what you think!

Greetings,
.mario]]> Anonymous User Projects Thu, 10 May 2007 15:54:17 -0500