Re: [Full-Disclosure] Phishing scam - Obfuscated url help please

Valdis.Kletnieks_at_vt.edu
Date: 01/23/04

  • Next message: Nick FitzGerald: "Re: [Full-Disclosure] Phishing scam - Obfuscated url help please" 
    To: nick@virus-l.demon.co.uk
Date: Thu, 22 Jan 2004 22:55:26 -0500

    On Fri, 23 Jan 2004 14:48:43 +1300, Nick FitzGerald <nick@virus-l.demon.co.uk> said:

    > as the "@" is (incorrectly) interpreted by many browsers (most in terms
    > of absolute use) as indicating the username part of the "userinfo" part
    > of the generic URI scheme.

    RFC2396 - Uniform Resource Identifiers (URI): Generic Syntax

    3.2.2. Server-based Naming Authority

       URL schemes that involve the direct use of an IP-based protocol to a
       specified server on the Internet use a common syntax for the server
       component of the URI's scheme-specific data:

          <userinfo>@<host>:<port>

       where <userinfo> may consist of a user name and, optionally, scheme-
       specific information about how to gain authorization to access the
       server. The parts "<userinfo>@" and ":<port>" may be omitted.

          server = [ [ userinfo "@" ] hostport ]

       The user information, if present, is followed by a commercial at-sign
       "@".

          userinfo = *( unreserved | escaped |
                             ";" | ":" | "&" | "=" | "+" | "$" | "," )

       Some URL schemes use the format "user:password" in the userinfo
       field. This practice is NOT RECOMMENDED, because the passing of
       authentication information in clear text (such as URI) has proven to
       be a security risk in almost every case where it has been used.

    Looks like a correct interpretation to me.

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

    • application/pgp-signature attachment: stored
  • Next message: Nick FitzGerald: "Re: [Full-Disclosure] Phishing scam - Obfuscated url help please"

    Relevant Pages

    • Re: Web authentication
      ... RFC 2396: Uniform Resource Identifiers (URI): Generic Syntax ... Server-based Naming Authority ... specified server on the Internet use a common syntax for the server ...
      (comp.lang.python)
    • Re: Sharing/Forwarding website credentials programatically
      ... authentication over SSL against a standard Active Directory account. ... credentials to the application server, ... was essentialy how to encode those links so that the credentials were passed ... essentially in the request-headers or URI itself. ...
      (microsoft.public.inetserver.iis.security)
    • Re: URI without file extension (Was: how to make a link to an old page go to a new page without disp
      ... I'm not using a server; ... You should either find an existing utility, or program one, that changes all the relative URI to other local files, inside html files, and replace them with URI lacking the extension. ... Link it from his own web site, from a weblog, from a web BBS, from a Usenet newsgroup, from a paper book, from an online news site or from a physical newspaper, from an online or offline revue article. ... But that doesn't solve the problem of people who bookmarked your website, and won't come back before 3 years. ...
      (comp.infosystems.www.authoring.html)
    • Re: URI without file extension (Was: how to make a link to an old page go to a new page without disp
      ... I'm not using a server; ... You should either find an existing utility, or program one, that changes all the relative URI to other local files, inside html files, and replace them with URI lacking the extension. ... I understand that broken authoring tools have as much responsibility as authors in the infamous 404 reply. ...
      (comp.infosystems.www.authoring.html)
    • Re: Sharing/Forwarding website credentials programatically
      ... What you are wanting is not really delegation of credentials from the portal ... can directly contact that server). ... authentication over SSL against a standard Active Directory account. ... essentially in the request-headers or URI itself. ...
      (microsoft.public.inetserver.iis.security)