Tag Info

New answers tagged

0

Yes, GlassFish does filter newline characters in headers. Tomcat does as well. I don't know about other servlet containers (Jetty, WebSphere, etc.) com.sun.net.httpserver does NOT filter newlines, so you can use that for your simulation.


1

If you are trying to catalog all possible attack inputs, creating a list of all form input fields would be incomplete and could lead you to having a false sense of security. There are many other potential origins of attack (parameters in the URL is a very common one). One thing that helped me when I began looking at website security was to start viewing it ...



Top 50 recent answers are included