Collected research
The minefield between syntaxes: exploiting syntax confusion
The minefield between syntaxes: exploit syntax confusion in the wild
Parsers in one stack accept different syntaxes for the same value: Python and Perl named unicode escapes, Content-Disposition filename versus filename*, file URIs carrying a host, and PHP parse_url ports with leading zeros. Attackers use the disagreement to bypass filters, poison a cache into stored XSS, and turn a limited SSRF into arbitrary file read.
Record
- Document
- The minefield between syntaxes: exploit syntax confusion in the wild
- Researcher
- Alex Brumen
- Published by
- YesWeHack
- Date
- Topic
- Other
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of Alex Brumen, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .