RE: [Full-Disclosure] Re: Internet Explorer URL parsing vulnerabi lity
From: Bill Royds (full-disclosure_at_royds.net)
Date: 12/12/03
- Previous message: Stefan Hecker: "[Full-Disclosure] xchat 2.0.6 crashes with mirc 6.0-6.11 DCC exploit"
- In reply to: Mortis: "RE: [Full-Disclosure] Re: Internet Explorer URL parsing vulnerabi lity"
- Next in thread: Nick FitzGerald: "RE: [Full-Disclosure] Re: Internet Explorer URL parsing vulnerabi lity"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: "'Mortis'" <m0rtis@adelphia.net>, <full-disclosure@lists.netsys.com> Date: Thu, 11 Dec 2003 20:27:20 -0500
Even better check out (from RFC1738)
3.3. HTTP
The HTTP URL scheme is used to designate Internet resources
accessible using HTTP (HyperText Transfer Protocol).
The HTTP protocol is specified elsewhere. This specification only
describes the syntax of HTTP URLs.
An HTTP URL takes the form:
http:// where <host> and <port> are as described in Section 3.1. If :<port>
Within the <path> and <searchpart> components, "/", ";", "?" are
Which says that a browser should not allow the username:password part for a
-----Original Message-----
> Using internet explorer, you can also put
J,
Check out 3.1 in this doc.
http://www.faqs.org/rfcs/rfc1738.html
I haveto clean the beeeeer off my keyyyyboard.
:)
_______________________________________________
_______________________________________________
is omitted, the port defaults to 80. No user name or password is
allowed. <path> is an HTTP selector, and <searchpart> is a query
string. The <path> is optional, as is the <searchpart> and its
preceding "?". If neither <path> nor <searchpart> is present, the "/"
may also be omitted.
reserved. The "/" character may be used within HTTP to designate a
hierarchical structure.
HTTP protocol base URL
From: full-disclosure-admin@lists.netsys.com
[mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Mortis
Sent: December 11, 2003 6:46 PM
To: full-disclosure@lists.netsys.com
Subject: RE: [Full-Disclosure] Re: Internet Explorer URL parsing vulnerabi
lity
> http://whateverhere@google.com and
> that will take you to google. It only matters
> what you put after the @ sign.
> I noticed that one day while putting in my email
> address in for hotmail.
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
Relevant Pages
... the standard HTTP url schema dosn't include the "hash" ... the serverside web service have no idea of the "hash" parameter no matter ...
(microsoft.public.dotnet.framework.aspnet.webcontrols)
... the RFC specification says that http authentication is not ... The HTTP URL scheme is used to designate Internet resources ...
(NT-Bugtraq)
... >>Why do I get this dialog when hovering over the menu? ... > Are there any images being pulled from an http URL instead of an https ...
(microsoft.public.dotnet.framework.aspnet)
... Not through the HTTP protocol. ... provided in PHP. ... It is if you're using HTTP protocol. ... ends of a data connection and you don't need a separate web server. ...
(comp.lang.php)
... had the right http protocol, and tried a few variations, but nothing. ... "Publisher web publication forms 101": ... what is the difference between HTTP and FTP uploading ...
(microsoft.public.publisher.webdesign)
