Collected research
Lost in Translation (ASP's HomoXSSuality)
Lost in Translation (ASP’s HomoXSSuality)
Classic ASP's Request() silently transliterates non-ASCII characters into the ASCII letters they resemble or sound like, an undocumented behaviour dropped in ASP.NET. A VBScript and JavaScript harness enumerated the full mapping table, finding three homoglyphs for '<' and five for the apostrophe, so a %u-escaped query string reaches the application as a working script tag and slips past anti-XSS filters and WAFs.
Record
- Document
- Lost in Translation (ASP’s HomoXSSuality)
- Researcher
- ma1
- Published by
- hackademix.net
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of ma1, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .