Nohack XSS
UrlScan配置 II
Aug
7
GET /%0A%0D HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; zh-CN; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 (.NET CLR 3.5.30729)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cache-Control: max-age=0
HTTP/1.x 400 Bad Request
Content-Type: text/html
Date: Fri, 07 Aug 2009 04:12:39 GMT
Connection: close
Content-Length: 34
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; zh-CN; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 (.NET CLR 3.5.30729)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cache-Control: max-age=0
HTTP/1.x 400 Bad Request
Content-Type: text/html
Date: Fri, 07 Aug 2009 04:12:39 GMT
Connection: close
Content-Length: 34
GET部分未进行 UrlEncode造成Bad Request。同时 header() 注入%0d%0a 时也可用 UrEncode() 进行解决。
S
2009/08/07 19:31
终于发啦。。。
woyigui 回复于 2009/08/07 20:52
哈，这个和那个不一样，这个只是一小部分。。这个只在当前会话中引发，不会持久！并且没有攻击性，所以只算是 BUG。。
分页： 1/1 
1 
1
