Johannes Kuhn

129 reputation

	129 reputation	bio	website		visits	member for	8 months
3 badges		location			seen	May 15 at 14:11

9 Actions

May 12	comment	XSS via Unicode A bad idea to setup the browser that way, but I'd say that is nothing you can prevent. (And very hard/impossible for an attacker to force that).
May 12	comment	XSS via Unicode @user85030 see the wiki page for UTF-7. An other problem is that an attacker could send a invalid sequence (`\700\600` instead `\000`), that an other side interprets as the NULL char. Ohh, I forgot: many characters can be encoded with different sequences, so the Umlauts: as single codepoint or as `a` with two dots over it. (2 codepoints)
May 12	comment	XSS via Unicode @user85030 Because it can decode the attack `<script src="...">` correctly. And that is all what matters for XSS.
May 11	answered	XSS via Unicode
Feb 14	awarded	Teacher
Feb 14	awarded	Editor
Feb 14	revised	What is the point of hashing passwords? added 405 characters in body
Feb 14	answered	What is the point of hashing passwords?
Sep 1	awarded	Supporter