Fw: ereg_replace problem

From: Noam Rathaus (noamrat_private)
Date: Mon Mar 04 2002 - 09:49:12 PST

Next message: H D Moore: "mod_php / mod_ssl plugin code"

Previous message: Pavel Kankovsky: "Re: False Positive in cross_site_scripting.nasl"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi,

I haven't received an answer yet, this is a ereg bug, and it is quite serious
since it doesn't correctly capture the needed string.

Thanks
Noam Rathaus
CTO
Beyond Security Ltd
http://www.SecurITeam.com
http://www.BeyondSecurity.com
----- Original Message -----
From: "Renaud Deraison" <deraisonat_private>
Sent: Sunday, February 24, 2002 21:29
Subject: Re: ereg_replace problem


> On Sat, Feb 23, 2002 at 02:40:41PM +0200, Noam Rathaus wrote:
>
> Hi Noam,
>
>
> >    The following:
> >    quote = raw_string(0x22);
> >    capture = string("<a
> >
href=javascript:openNewWindow('month.htm','month','height=485,width=645,toolbar=
no,scrollbars=yes')
> >    id=", quote
> >    , "flashlink", quote, " onMouseover=", quote, "window.status='.... .....
> >    ......'; return true", quote, " onMouseout=", quote, "windo
> >    w.status=' ';return true", quote, " flashtype=0 flashcolor=", quote,
> >    "yellow", quote, " target=", quote, "_parent", quote, ">");
> >
> >    url = ereg_replace(pattern:".*< *(a|area|frame) *.* (href|src)=([^> ]*)
> >    >.*", string:capture, icase:1, replace:"\1");
> >    NASL seems to fail to find the HREF... something wrong the ereg_replace()
>
>
> I'll try to identify that (and the other mail you sent me). Please ping
> me again this week regarding that issue so that we make sure I work on
> it :)
>
> -- Renaud
>

Next message: H D Moore: "mod_php / mod_ssl plugin code"
Previous message: Pavel Kankovsky: "Re: False Positive in cross_site_scripting.nasl"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon Mar 04 2002 - 09:49:37 PST