Re: IE URL obfuscation

• Previous message: securityalerts_at_PENNYSAVERUSA.NET: "Re: More on IE URL obfuscation"
• Maybe in reply to: Ben Reardon: "IE URL obfuscation"
• Next in thread: Jeroen Frijters: "Re: IE URL obfuscation"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date:         Thu, 11 Dec 2003 17:49:59 -0500
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

I'm using a simple proxy.pac/wpad.dat:

function FindProxyForURL(url, host){
 if (url.indexOf("?@") != -1) {
   alert('Possible hack. Proceed with caution.');
 }
}

I'd rather MS patch the browser, but in the meantime, this works
for me. You can just add the other URL strings, \0x01 and any others
that come up. And it's a little easier than telling people to always
check the SSL certificate or right-click/Properties to get the actual
URL (which correctly shows the full URL, unlike the address bar).

I can't wait to get directed to sites that put their names in the URLs:
http://www.slashdot.org?@%56%69%61%67%72%61

Also, you can use hex on the ?@, so:
http://www.securityfocus.com%3f%40www.google.com?a=b

Also, if you double-hex-encrypt '/', you can somewhat use directories:
/ = %2f
%2F = @25 %32 %66
http://www.securityfocus.com%25%32%66archive?@www.google.com
returns a 404 the first time, but then the correct page the second, and
sometimes correct pages, sometimes not after that. I don't know WHAT ie
is doing with the URL, but I've got a funny feeling there are some more
exploits in this category...

Michael Scovetta

----
NTBugtraq subscribers save $103.00 off the TICSA exam by using promo
code "NT1003" when registering to take the TICSA exam at www.2test.com.
Prove to your employer and peers that you have the knowledge and
abilities to be an active stakeholder in today's enterprise security.
Become TICSA certified www.trusecure.com/ticsa.  Promotion expires
12/31/03 and cannot be used in combination with other offers.
----

• Previous message: securityalerts_at_PENNYSAVERUSA.NET: "Re: More on IE URL obfuscation"
• Maybe in reply to: Ben Reardon: "IE URL obfuscation"
• Next in thread: Jeroen Frijters: "Re: IE URL obfuscation"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]