Collected research
Rare ASP.NET request validation bypass using request encoding
ASP.NET's request validation throws on the first read of Request.QueryString or Request.Form, so an application that swallows the exception with an empty catch or On Error Resume Next gets the payload back unchecked on every later read. Encoding the parameters as ibm037 or utf-32 and declaring that charset on Content-Type carries <script>alert(1)</script> past intervening WAFs too, and the verb can be swapped to move the payload between URL and body. Microsoft closed it as won't fix.
Record
- Researcher
- Soroush Dalili
- Published by
- NCC Group
- Topic
- Server
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Soroush Dalili, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .