Unicode Encoding - Revision history

Laurence Casey: Reverted edits by ZelsiTcc4t (Talk) to last version by KirstenS

2009-05-26T19:55:33Z

Reverted edits by ZelsiTcc4t (Talk) to last version by KirstenS

Deleted user at 12:13, 26 May 2009

2009-05-26T12:13:03Z

Deleted user at 20:39, 22 May 2009

2009-05-22T20:39:01Z

KirstenS at 11:52, 23 April 2009

2009-04-23T11:52:49Z

KirstenS at 23:08, 7 April 2009

2009-04-07T23:08:49Z

KirstenS: /* References */

2009-02-17T01:17:56Z

‎References

KirstenS: /* Examples */

2009-02-17T01:15:25Z

‎Examples

KirstenS at 01:13, 17 February 2009

2009-02-17T01:13:24Z

KirstenS: /* Related Vulnerabilities */

2008-09-15T13:05:26Z

‎Related Vulnerabilities

KirstenS: /* Related Threat Agents */

2008-09-15T13:05:04Z

‎Related Threat Agents

@@ Line 1: / Line 1: @@
 {{Template:Attack}}
 <br>
@@ Line 12: / Line 10: @@
 ==Examples ==
-Consider a web application which has restricted directories or files (e.g. a file containing application usernames: appusers.txt). An attacker can encode the character sequence Ã¢ÂÂ../Ã¢ÂÂ ([[Path Traversal]] Attack) using Unicode format and attempt to access the protected resource, as follows:
+Consider a web application which has restricted directories or files (e.g. a file containing application usernames: appusers.txt). An attacker can encode the character sequence “../” ([[Path Traversal]] Attack) using Unicode format and attempt to access the protected resource, as follows:
 Original Path Traversal attack URL (without Unicode Encoding):
@@ Line 22: / Line 20: @@
   <nowiki>http://vulneapplication/%C0AE%C0AE%C0AF%C0AE%C0AE%C0AFappusers.txt</nowiki>
-The Unicode encoding for the URL above will produce the same result as the first URL (Path Traversal Attack). However, if the application has an input security filter mechanism, it could refuse any request containing Ã¢ÂÂ../Ã¢ÂÂ sequence, thus blocking the attack. However, if this mechanism doesnÃ¢ÂÂt consider character encoding, the attacker can bypass and access protected resource.
+The Unicode encoding for the URL above will produce the same result as the first URL (Path Traversal Attack). However, if the application has an input security filter mechanism, it could refuse any request containing “../” sequence, thus blocking the attack. However, if this mechanism doesn’t consider character encoding, the attacker can bypass and access protected resource.
 Other consequences of this type of attack are privilege escalation, arbitrary code execution, data modification, and denial of service.

@@ Line 1: / Line 1: @@
 http://www.textletoouacsi.com
 {{Template:Attack}}
@@ Line 11: / Line 12: @@
 ==Examples ==
-Consider a web application which has restricted directories or files (e.g. a file containing application usernames: appusers.txt). An attacker can encode the character sequence â../â ([[Path Traversal]] Attack) using Unicode format and attempt to access the protected resource, as follows:
+Consider a web application which has restricted directories or files (e.g. a file containing application usernames: appusers.txt). An attacker can encode the character sequence Ã¢ÂÂ../Ã¢ÂÂ ([[Path Traversal]] Attack) using Unicode format and attempt to access the protected resource, as follows:
 Original Path Traversal attack URL (without Unicode Encoding):
@@ Line 21: / Line 22: @@
   <nowiki>http://vulneapplication/%C0AE%C0AE%C0AF%C0AE%C0AE%C0AFappusers.txt</nowiki>
-The Unicode encoding for the URL above will produce the same result as the first URL (Path Traversal Attack). However, if the application has an input security filter mechanism, it could refuse any request containing â../â sequence, thus blocking the attack. However, if this mechanism doesnât consider character encoding, the attacker can bypass and access protected resource.
+The Unicode encoding for the URL above will produce the same result as the first URL (Path Traversal Attack). However, if the application has an input security filter mechanism, it could refuse any request containing Ã¢ÂÂ../Ã¢ÂÂ sequence, thus blocking the attack. However, if this mechanism doesnÃ¢ÂÂt consider character encoding, the attacker can bypass and access protected resource.
 Other consequences of this type of attack are privilege escalation, arbitrary code execution, data modification, and denial of service.

@@ Line 1: / Line 1: @@
 {{Template:Attack}}
 <br>
@@ Line 10: / Line 11: @@
 ==Examples ==
-Consider a web application which has restricted directories or files (e.g. a file containing application usernames: appusers.txt). An attacker can encode the character sequence “../” ([[Path Traversal]] Attack) using Unicode format and attempt to access the protected resource, as follows:
+Consider a web application which has restricted directories or files (e.g. a file containing application usernames: appusers.txt). An attacker can encode the character sequence â../â ([[Path Traversal]] Attack) using Unicode format and attempt to access the protected resource, as follows:
 Original Path Traversal attack URL (without Unicode Encoding):
@@ Line 20: / Line 21: @@
   <nowiki>http://vulneapplication/%C0AE%C0AE%C0AF%C0AE%C0AE%C0AFappusers.txt</nowiki>
-The Unicode encoding for the URL above will produce the same result as the first URL (Path Traversal Attack). However, if the application has an input security filter mechanism, it could refuse any request containing “../” sequence, thus blocking the attack. However, if this mechanism doesn’t consider character encoding, the attacker can bypass and access protected resource.
+The Unicode encoding for the URL above will produce the same result as the first URL (Path Traversal Attack). However, if the application has an input security filter mechanism, it could refuse any request containing â../â sequence, thus blocking the attack. However, if this mechanism doesnât consider character encoding, the attacker can bypass and access protected resource.
 Other consequences of this type of attack are privilege escalation, arbitrary code execution, data modification, and denial of service.

← Older revision		Revision as of 11:52, 23 April 2009
Line 3:		Line 3:
	[[Category:OWASP ASDR Project]]		[[Category:OWASP ASDR Project]]

		+
		+	Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''

	==Description==		==Description==

← Older revision		Revision as of 23:08, 7 April 2009
Line 2:		Line 2:
	<br>		<br>
	[[Category:OWASP ASDR Project]]		[[Category:OWASP ASDR Project]]
−	~~[[ASDR Table of Contents]]~~

@@ Line 43: / Line 43: @@
 * http://www.microsoft.com/technet/security/bulletin/MS00-078.mspx - Patch Available for 'Web Server Folder Traversal' Vulnerability
 * http://www.kb.cert.org/vuls/id/739224 - HTTP content scanning systems full-width/half-width Unicode encoding bypass
 * http://scissec.scis.ecu.edu.au/conferences2007/documents/cheong_kai_wai_1.pdf - Penetration testing of cross site scripting and SQL injection on web application by Cheong Kai Wee
-* http://www.cgisecurity.com/lib/URLEmbeddedAttacks.html - URL encoded attacks, by Gunter Ollmann
 [[Category:Resource Manipulation]]
 [[Category:Attack]]

@@ Line 2: / Line 2: @@
 <br>
 [[Category:OWASP ASDR Project]]
-[[ASDR Table of Contents]]__TOC__
+[[ASDR Table of Contents]]
 ==Description==
 The attack aims to explore flaws in the decoding mechanism implemented on applications when decoding Unicode data format. An attacker can use this technique to encode certain characters in the URL to bypass application filters, thus accessing restricted resources on the Web server or to force browsing to protected pages.
 ==Examples ==
 Consider a web application which has restricted directories or files (e.g. a file containing application usernames: appusers.txt). An attacker can encode the character sequence “../” ([[Path Traversal]] Attack) using Unicode format and attempt to access the protected resource, as follows:

@@ Line 42: / Line 42: @@
 ==Related [[Vulnerabilities]]==
-* [[:Category:Input Validation]]
+* [[:Category:Input Validation Vulnerability]]
 ==Related [[Controls]]==

@@ Line 35: / Line 35: @@
 * [[:Category:Command Execution]]
 * [[:Category:Information Disclosure]]
 ==Related [[Attacks]]==