Connection between "XSS" and "Unicode transformation issues" vulnerability ?

apocalypse0
9 years ago

0

HELLO.

I run a scan of XSS with Acunetix and Acunetix as a result shows that my site is vulnerable “HIGHT” to “Unicode Transformation issues”.
(https://www.owasp.org/index.php/Canonicalization,_locale_and_Unicode).

https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet (
XSS (Link “XSS Filter Evasion Cheat Sheet”) for determining whether one is vulnerable to
Unicode transformation issues

EXAMPLE:

http://www.example.com/cgi-bin/bad.cgi?foo=../../bin/ls%20-al

URL Encoding of the example attack:

http://www.example.com/cgi-bin/bad.cgi?foo=..%2F../bin/ls%20-al

Unicode encoding of the example attack:

http://www.example.com/cgi-bin/bad.cgi?foo=..%c0%af../bin/ls%20-al

http://www.example.com/cgi-bin/bad.cgi?foo=..%c1%9c../bin/ls%20-al

http://www.example.com/cgi-bin/bad.cgi?foo=..%c1%pc../bin/ls%20-al

http://www.example.com/cgi-bin/bad.cgi?foo=..%c0%9v../bin/ls%20-al

http://www.example.com/cgi-bin/bad.cgi?foo=..%c0%qf../bin/ls%20-al

http://www.example.com/cgi-bin/bad.cgi?foo=..%c1%8s../bin/ls%20-al

http://www.example.com/cgi-bin/bad.cgi?foo=..%c1%1c../bin/ls%20-al

http://www.example.com/cgi-bin/bad.cgi?foo=..%c1%9c../bin/ls%20-al

http://www.example.com/cgi-bin/bad.cgi?foo=..%c1%af../bin/ls%20-al

http://www.example.com/cgi-bin/bad.cgi?foo=..%e0%80%af../bin/ls%20-al

http://www.example.com/cgi-bin/bad.cgi?foo=..%f0%80%80%af../bin/ls%20-al

http://www.example.com/cgi-bin/bad.cgi?foo=..%f8%80%80%80%af../bin/ls%20-al

So why is it when I launch an XSS scan I get the results of vulnerability “Unicode transformation issues” ?

I want to know if there is a connection between XSS and Unicode transformation issues ???

thank you

13replies
3voices
696views
1image
Mugi [Mugiwara27]
9 years ago | edited 9 years ago
apocalypse0
9 years ago

0

ok great thank you dear friend for answering me, but I wonder if vulnerabilities “Unicode transformation issues” will operate exactly as we exploit vulnerabilities “XSS” ???

Also, tell me if this is the vulnerabilities “Unicode transformation issues” that are still called “XSS Filter Evasion Cheat Sheet” ???? If so, tell me if vulnerabilities “XSS Filter Evasion Cheat Sheet” are used in exactly the same way as other vulnerabilities “XSS normal” exploited ???

Thank you in advance

Mugi [Mugiwara27]
9 years ago

0

Wow, It’s like you didn’t read my post
Unicode transformation issues is an asset in the exploitation of a XSS vulnerability
The XSS Filter Evasion Cheat Sheet… everything is writing in the title..

dloser
9 years ago

0

Give it up. He clearly has no idea what he’s doing and doesn’t seem to take advice.

Mugi [Mugiwara27]
9 years ago

0

Yes like I think he just ran some scanners but don’t understand them

apocalypse0
9 years ago

0

I frankly do not understand you; I wonder just if vulnerabilities “Unicode transformation issues” will operate exactly as we exploit vulnerabilities “XSS” ???

And if this is the vulnerabilities “Unicode transformation issues” that are still called “XSS Filter Evasion Cheat Sheet” ????

If so, tell me if vulnerabilities “XSS Filter Evasion Cheat Sheet” are used in exactly the same way as other vulnerabilities “XSS normal” exploited ???

Mugi [Mugiwara27]
9 years ago
apocalypse0
9 years ago

0

Ok so I understand, a site that is vulnerable to “Unicode transformation issues” is not vulnerable to XSS ???

Mugi [Mugiwara27]
9 years ago

0

Retard a little I think
Read my post !

dloser
9 years ago

0

The way you use terms like “XSS Filter Evasion Cheat Sheet” shows you are just copy/pasting stuff from wherever without having the slightest clue what they mean. As I told you before, instead of just running tools and then asking us to interpret the data, try to understand the basics first.

apocalypse0
9 years ago

-2

But I’m trying to understand is why I ask you questions because when I finished reading the articles, I’m really confux why I come to this forum for better understanding.

So please just tell me if a site that is vulnerable to “Unicode transformation issues” is not vulnerable to XSS ???

Because the results after scanning my site shows that it has a vulnerability “HIGHT” from “Unicode Transformation issues” when I had just started a scan “XSS” with Acunetix web vulnerability scanner.

So please just tell me if a site that is vulnerable to “Unicode transformation issues” is not vulnerable to XSS ???

Or tell me if vulnerabilities “Unicode transformation issues” are also the vulnerabilities “XSS” because I do not understand why I select and I run a scan “XSS” and I get a result of vulnerability “Unicode Transformation issues” ?? ?

Please explain to me because I really want to understand why I selected and launched a scan “XSS” and subsequently obtained a result of vulnerability “Unicode Transformation issues” with the scanner ???

Do you think the “Unicode transformation issues” vulnerabilities are also (exactly) as vulnerabilities “XSS” ???

Thank you in advance.

Mugi [Mugiwara27]
9 years ago

0

In every post you have written, you are copying / pasting what you have already said…

Mugi [Mugiwara27]
9 years ago | edited 9 years ago

0

wtf, how did you found my Facebook account ? lmao
( He is asking the same thing here but in French )

Image

You must be logged in to reply to this discussion. Login
1 of 14

This site only uses cookies that are essential for the functionality of this website. Cookies are not used for tracking or marketing purposes.

By using our site, you acknowledge that you have read and understand our Privacy Policy, and Terms of Service.

Dismiss