Web Hack List

Collected research

Rare ASP.NET request validation bypass using request encoding

ASP.NET's request validation throws on the first read of Request.QueryString or Request.Form, so an application that swallows the exception with an empty catch or On Error Resume Next gets the payload back unchecked on every later read. Encoding the parameters as ibm037 or utf-32 and declaring that charset on Content-Type carries <script>alert(1)</script> past intervening WAFs too, and the verb can be swapped to move the payload between URL and body. Microsoft closed it as won't fix.

Record

Researcher
Soroush Dalili
Published by
NCC Group
Topic
Server

In the archive

Tags

This page is the archive's own catalogue record. The research is the work of Soroush Dalili, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .