I've recently read about utf-7 XSS-attacks (i.e. Ned Batchelders article at http://nedbatchelder.com/blog/200704/xss_with_utf7.htmlNed Batchelders article on UTF-7 XSS-attacks). I tested his examples, but could not get any UTF-7 attack to work in modern browsers. (II tried recent versions of Firefox, Chrome and Safari so far - I basically tested Ned Batchelders example at http://nedbatchelder.com/utf7.html.)
So: Does anybody know why this is not working anymore? It seems that the UTF-7 detection mechanism has changed, maybe even for security reasons? Can UTF-7 attacks still target modern browsers if there is no way to change charset declaration within the document or manipulate the headers?
Thanks for any additional info on this topic.