Back to Blog
NoScript New Bypass Method by Unicode in ASP
NoScript v2.0.2.3 does not have this problem anymore. Thanks to its author. As I’d told Giorgio, all the problems will be reported to him first
Woohoo! You/We/They/or whatever! can still use unicode in some places!
NoScript cannot find out special unicode characters which mean something in ASP:
PoC:
In this example I selected the characters from: http://rishida.net/scripts/uniview/uniview.php . For instance:
%u2329 = <
%u0131 = i
%u232A = >
%u212F = e
From Microsoft point of view! Therefore, IE8 XSS prevention can detect this encoding and NoScript cannot detect it.
This entry was posted in Security Posts
Creation date: August 9, 2010