Canonicalization, locale and Unicode - Revision history

Shady: Further Reading

2013-05-12T16:54:20Z

Jason Li: Undo revision 61219 by LalaoUliac (Talk)

2009-05-21T21:24:22Z

Undo revision 61219 by LalaoUliac (Talk)

Deleted user at 21:15, 21 May 2009

2009-05-21T21:15:39Z

Jason Li: This page is linked by an external page (Application Security and Development STIG: disa.mil)

2009-04-28T20:33:52Z

This page is linked by an external page (Application Security and Development STIG: disa.mil)

KirstenS: /* Further Reading */

2009-03-04T02:17:24Z

‎Further Reading

KirstenS: /* How to protect yourself */

2009-03-04T02:15:24Z

‎How to protect yourself

KirstenS: /* How to determine if you are vulnerable */

2009-03-04T02:13:43Z

‎How to determine if you are vulnerable

KirstenS: /* How to determine if you are vulnerable */

2008-08-27T22:23:29Z

‎How to determine if you are vulnerable

KirstenS: /* HTTP Request Smuggling */

2008-08-20T11:02:54Z

‎HTTP Request Smuggling

KirstenS: /* Unicode */

2008-08-20T10:59:05Z

‎Unicode

@@ Line 257: / Line 257: @@
 * HTTP Request Smuggling
-<u>http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf</u> [[category:FIXME | this does not go to  the intended page]]
+<u>http://www.cgisecurity.com/lib/http-request-smuggling.pdf</u>
 * XSS Cheat Sheet

@@ Line 1: / Line 1: @@
 [[Guide Table of Contents|Development Guide Table of Contents]]__TOC__
@@ Line 12: / Line 11: @@
 ==Relevant COBIT Topics ==
-DS11.9 â Data processing integrity
+DS11.9 – Data processing integrity
 ==Description ==
-Applications are rarely tested for Unicode exploits, and yet many are vulnerable due to the same sort of issues which allows HTTP Request Smuggling to work â every browser, web server, web application firewall or HTTP inspection agent, and other device treats user locale handling in different (and usually confusing) manner.
+Applications are rarely tested for Unicode exploits, and yet many are vulnerable due to the same sort of issues which allows HTTP Request Smuggling to work – every browser, web server, web application firewall or HTTP inspection agent, and other device treats user locale handling in different (and usually confusing) manner.
 Canonicalization deals with the way in which systems convert data from one form to another. Canonical means the simplest or most standard form of something. Canonicalization is the process of converting something from one representation to the simplest form.
@@ Line 144: / Line 143: @@
 * .NET: Unicode (little endian)
-* JSP implementations, such as Tomcat: UTF8 - see âjavaEncodingâ in web.xml by many servlet containers
+* JSP implementations, such as Tomcat: UTF8 - see “javaEncoding” in web.xml by many servlet containers
 * Java: Unicode (UTF-16, big endian, '''''or''''' depends on the OS during JVM startup)
@@ Line 154: / Line 153: @@
 ===How to protect yourself ===
-* Determine your applicationâs needs, and set both the asserted language locale and character set appropriately.
+* Determine your application’s needs, and set both the asserted language locale and character set appropriately.
 ==Locale assertion ==
-The web server should always assert a locale and preferably a country code, such as âen_USâ, âfr_FRâ, âzh_CNâ
+The web server should always assert a locale and preferably a country code, such as “en_US”, “fr_FR”, “zh_CN”
 ===How to determine if you are vulnerable ===

@@ Line 1: / Line 1: @@
 [[Guide Table of Contents|Development Guide Table of Contents]]__TOC__
@@ Line 11: / Line 12: @@
 ==Relevant COBIT Topics ==
-DS11.9 – Data processing integrity
+DS11.9 â Data processing integrity
 ==Description ==
-Applications are rarely tested for Unicode exploits, and yet many are vulnerable due to the same sort of issues which allows HTTP Request Smuggling to work – every browser, web server, web application firewall or HTTP inspection agent, and other device treats user locale handling in different (and usually confusing) manner.
+Applications are rarely tested for Unicode exploits, and yet many are vulnerable due to the same sort of issues which allows HTTP Request Smuggling to work â every browser, web server, web application firewall or HTTP inspection agent, and other device treats user locale handling in different (and usually confusing) manner.
 Canonicalization deals with the way in which systems convert data from one form to another. Canonical means the simplest or most standard form of something. Canonicalization is the process of converting something from one representation to the simplest form.
@@ Line 143: / Line 144: @@
 * .NET: Unicode (little endian)
-* JSP implementations, such as Tomcat: UTF8 - see “javaEncoding” in web.xml by many servlet containers
+* JSP implementations, such as Tomcat: UTF8 - see âjavaEncodingâ in web.xml by many servlet containers
 * Java: Unicode (UTF-16, big endian, '''''or''''' depends on the OS during JVM startup)
@@ Line 153: / Line 154: @@
 ===How to protect yourself ===
-* Determine your application’s needs, and set both the asserted language locale and character set appropriately.
+* Determine your applicationâs needs, and set both the asserted language locale and character set appropriately.
 ==Locale assertion ==
-The web server should always assert a locale and preferably a country code, such as “en_US”, “fr_FR”, “zh_CN”
+The web server should always assert a locale and preferably a country code, such as âen_USâ, âfr_FRâ, âzh_CNâ
 ===How to determine if you are vulnerable ===

← Older revision		Revision as of 20:33, 28 April 2009
Line 268:		Line 268:
	[[Category:Canonicalization]]		[[Category:Canonicalization]]
	[[Category:Encoding]]		[[Category:Encoding]]
		+	[[Category:Externally Linked Page]]

@@ Line 257: / Line 257: @@
 * HTTP Request Smuggling
-<u>http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf</u>
+<u>http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf</u> [[category:FIXME | this does not go to  the intended page]]
 * XSS Cheat Sheet

@@ Line 211: / Line 211: @@
 * Assert the correct locale and character set for your application
-* Use HTML entities, URL encoding and so on to prevent Unicode characters being treated improperly by the many divergent browser, server and application combinations
+* Use HTML entities, URL encoding, and so on to prevent Unicode characters being treated improperly by the many divergent browser, server, and application combinations
 * Test your code and overall solution extensively

@@ Line 133: / Line 133: @@
 ===How to determine if you are vulnerable ===
-Investigate the web application to determine if it asserts an internal code page, locale or culture.
+Investigate the web application to determine if it asserts an internal code page, locale, or culture.
 If the default character set, locale is not asserted it will be one of the following:

@@ Line 163: / Line 163: @@
 Use a HTTP header sniffer or even just telnet against your web server:
-''HEAD / HTTP1.0''
+<pre>
 Should display something like this:
-''HTTP/1.1 200 OK''
+<pre>
-''Date: Sun, 24 Jul 2005 08:13:17 GMT''
+Date: Sun, 24 Jul 2005 08:13:17 GMT
-''Server: Apache/1.3.29''
+Server: Apache/1.3.29
-''Connection: close''
+Connection: close
-''Content-Type: text/html;''''' charset=iso-8859-1'''
+Content-Type: text/html;''''' charset=iso-8859-1'
 ===How to protect yourself ===

@@ Line 213: / Line 213: @@
 ==HTTP Request Smuggling ==
-HTTP Request Smuggling (HRS) is an issue detailed in depth by Klein, Linhart, Heled, and Orrin in a whitepaper found in the references section. The basics of HTTP Request Smuggling is that many larger solutions use many components to provide a web application. The differences between the firewall, web application firewall, load balancers, SSL accelerators, reverse proxies, and web servers allow a specially crafted attack to bypass all the controls in the front-end systems and directly attack the web server.
+[[HTTP Request Smuggling]] (HRS) is an issue detailed in depth by Klein, Linhart, Heled, and Orrin in a whitepaper found in the references section. The basics of HTTP Request Smuggling is that many larger solutions use many components to provide a web application. The differences between the firewall, web application firewall, load balancers, SSL accelerators, reverse proxies, and web servers allow a specially crafted attack to bypass all the controls in the front-end systems and directly attack the web server.
 The types of attack they describe are:

@@ Line 25: / Line 25: @@
 ==Unicode ==
-Unicode Encoding is a method for storing characters with multiple bytes. Wherever input data is allowed, data can be entered using Unicode to disguise malicious code and permit a variety of attacks. RFC 2279 references many ways that text can be encoded.
+Unicode Encoding is a method for storing characters with multiple bytes. Wherever input data is allowed, data can be entered using [[Unicode Encoding|Unicode]] to disguise malicious code and permit a variety of attacks. RFC 2279 references many ways that text can be encoded.
 Unicode was developed to allow a Universal Character Set (UCS) that encompasses most of the world's writing systems. Multi-octet characters, however, are not compatible with many current applications and protocols, and this has led to the development of a few UCS transformation formats (UTF) with varying characteristics. UTF-8 has the characteristic of preserving the full US-ASCII range. It is compatible with file systems, parsers and other software relying on US-ASCII values, but it is transparent to other values.