How to Break Web Software: Functional and Security Testing of Web Applications and Web Services by Mike Andrews & James A. Whittaker

Author:Mike Andrews & James A. Whittaker [Andrews, Mike & Whittaker, James A.]
Language: eng
Format: epub
Tags: computers, Security, General
ISBN: 9780321657510
Google: zEWvS-sTiNUC
Publisher: Addison Wesley
Published: 2006-02-02T00:23:16.054523+00:00

When the Web server picked up the request, it knew it could do several things. It could be one of the higher (that is, non-ASCII) UTF-8 encoded characters, or it could decode the %25, find out that it’s a % character, and then decode the %5c. It should have been the former, but due to a shift-reduce parsing error in the decoding engine, it preferred the latter, which was the opposite of the application code. Once again, the vulnerability manifested itself.

WHEN to Apply This Attack

This attack is secondary to the majority of others listed in this book. Whenever you try an attack and it fails, the application may indicate that it is catching the input and validating it (error messages are produced). It is worth trying to circumvent the validation routine(s) while attempting to encode parts of the input.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.