I'm pretty sure this isn't the right forum for this, but I couldn't find one properly suited so I picked here.

There's a character I found on a foreign website that does some weird stuff and I'm pretty sure it could be used as an extremely effective bypass filter but I'm having all kinds of trouble figuring out how it can be used...

when you paste this character, everything after it is immediately reversed. (for this reason I'm not pasting the character till the end of this post)

that makes me think it might be possible to do something like this:

[pastecharhere]
<tpircs>
;(1)trela
<tpircs/>

and this actually works. I typed that code in notepad, and opened it in firefox/ie and it displays the way I want it to (forwards rather than backwards) but it doesn't execute as javascript. same with regular html.

Anyone have any ideas or know anything about this character?

&#8235;&#8236;&#8237;&#8238;&#8234;&#8235;&#8236;&#8237;&#8238;&#1161;

this is what I'm talking about. hopefully it doesn't mess up the forums ;(

hmm... looks like security slays this... look here:
[www1.freewebs.com]

Paste that char somewhere and start typing.



Edited 1 time(s). Last edit at 10/12/2007 01:39PM by tehryan.

This is right to left entity for arabic and other languages, although at first I thought there might be scope for using it in a exploit it appears that the browser only reverses the text on display and not when it is processing script.

The actual character is only
&#8238;
(1)trela=daolno emarfi>

I tried that code in FF, Opera and Safari, anyone want to try it in IE?

------------------------------------------------------------------------------------------------------------

(
[º,À,Æ,Ç,Å]=<ª><µ>{(![]+[])[+!![]+[]]}</µ>
<µ>{(![]+[])[+!![]+!![]+[]]}</µ>
<µ>{(!![]+[])[+!![]+!![]+!![]+[]]}</µ>
<µ>{(!![]+[])[+!![]+[]]}</µ><µ>{(!![]+[])[+[]]}</µ>
</ª>.*).*(\u0065\u0076\u0061\u006c([]+º+À+Æ+Ç+Å+['('+[+!+[]]+')'])).
@À.º.Æ.Å.Ç
"People who say it cannot be done should not interrupt those who are doing it."

labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [www.businessinfo.co.uk]



Edited 1 time(s). Last edit at 10/12/2007 04:19PM by Gareth Heyes.

Gareth: you're right. as far as I can tell from further playing around its only effecting display. I bet there are some interesting social engineering vectors still tho... for instance get your hands on this domain:
moc.lapyap.us(or other tld)
the browser would display
su.paypal.com

what do you make of this: [www.lapyap.com] ?

thornmaker Wrote:
-------------------------------------------------------
> what do you make of this: [www.lapyap.com] ?

A lame joke. It's an image for Rods sake.

-Spyware | [bitsofspy.net]

If don't get it completely wrong at the moment (2am *g*) it IS able to get it executed:

[php-ids.org]

-> copy with select-all from source view and try it on the php-ids demo *blush* - gotta work on that tomorrow ;)

---
g:0in~/*for another*/~alert(!!1)
(Å='',[Ç=!(µ=!Å+Å)+{}][Ç[ª=µ[++Å]+µ[Å-Å],È=Å-~Å]+Ç[È+È]+ª])()[Ç[Å]+Ç[Å+Å]+µ[È]+ª](Å)
me || PHPIDS || Twitter || <malicious></markup>

.mario: it works for me too. that's awesome!

@Mario

Tried it on FF and it didn't execute :(

Which browser did you try it on?

------------------------------------------------------------------------------------------------------------

(
[º,À,Æ,Ç,Å]=<ª><µ>{(![]+[])[+!![]+[]]}</µ>
<µ>{(![]+[])[+!![]+!![]+[]]}</µ>
<µ>{(!![]+[])[+!![]+!![]+!![]+[]]}</µ>
<µ>{(!![]+[])[+!![]+[]]}</µ><µ>{(!![]+[])[+[]]}</µ>
</ª>.*).*(\u0065\u0076\u0061\u006c([]+º+À+Æ+Ç+Å+['('+[+!+[]]+')'])).
@À.º.Æ.Å.Ç
"People who say it cannot be done should not interrupt those who are doing it."

labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [www.businessinfo.co.uk]

Just tried it again....
Whaaaooooo amazing!

It works!!!! Cool

------------------------------------------------------------------------------------------------------------

(
[º,À,Æ,Ç,Å]=<ª><µ>{(![]+[])[+!![]+[]]}</µ>
<µ>{(![]+[])[+!![]+!![]+[]]}</µ>
<µ>{(!![]+[])[+!![]+!![]+!![]+[]]}</µ>
<µ>{(!![]+[])[+!![]+[]]}</µ><µ>{(!![]+[])[+[]]}</µ>
</ª>.*).*(\u0065\u0076\u0061\u006c([]+º+À+Æ+Ç+Å+['('+[+!+[]]+')'])).
@À.º.Æ.Å.Ç
"People who say it cannot be done should not interrupt those who are doing it."

labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [www.businessinfo.co.uk]

Yeah but you'll have to copy/paste it, but then it reverses back to the proper direction.

dir="ltr"
dir="rtl"

I was unable to get it to execute any statements, but it's still a cool trick.


Awesome AnDrEw - That's The Sound Of Your Brain Crackin'
[www.awesomeandrew.net]

I read about this some time ago, just for those of you who are interested:
[neworder.box.sk]
[seclists.org]
seems like you can have alot of fun with this character ;)

It's more than one character btw - it's eight all together:

var i =0;
var j = String.fromCharCode
while(i < 65536) {try{eval('con'+j(i)+'sole.log("Found: '+i+' '+j(i)+'")');} catch(e) {}i++

Here's how to detect them:

if (preg_match('/(?:%E2%80%(?:A|8)\w|%EF%BB%BF)/i', urlencode($value))) {
  echo 'eeeew!';
}

---
g:0in~/*for another*/~alert(!!1)
(Å='',[Ç=!(µ=!Å+Å)+{}][Ç[ª=µ[++Å]+µ[Å-Å],È=Å-~Å]+Ç[È+È]+ª])()[Ç[Å]+Ç[Å+Å]+µ[È]+ª](Å)
me || PHPIDS || Twitter || <malicious></markup>

hehe

I dunno if it has been mentioned before but I found this tag interesting:-

<bdo dir="rtl">Hello</bdo>

------------------------------------------------------------------------------------------------------------

(
[º,À,Æ,Ç,Å]=<ª><µ>{(![]+[])[+!![]+[]]}</µ>
<µ>{(![]+[])[+!![]+!![]+[]]}</µ>
<µ>{(!![]+[])[+!![]+!![]+!![]+[]]}</µ>
<µ>{(!![]+[])[+!![]+[]]}</µ><µ>{(!![]+[])[+[]]}</µ>
</ª>.*).*(\u0065\u0076\u0061\u006c([]+º+À+Æ+Ç+Å+['('+[+!+[]]+')'])).
@À.º.Æ.Å.Ç
"People who say it cannot be done should not interrupt those who are doing it."

labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [www.businessinfo.co.uk]