Passing (poison) nulls in cookies

From: Franklin DeMatto (franklinat_private)
Date: Fri Apr 27 2001 - 11:06:55 PDT

Next message: Rajkumar S.: "Re: Hijack IP Address using cable modem"

Previous message: Franklin DeMatto: "ssh crc32 exploit on Linux"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Is there a way of passing (poison) nulls to cgi's in cookies???
That is, is there a way of getting cookies to contain a null???

It seems like apache will pass nulls in header lines fine, but being
that the cgi spec passes headers as env variables, the null will lop them
off.

Does anyone know of a solution, or a work around?


(The code I'm testing is something like:
	unlink "$cookie_name.user";
where $cookie_name is plucked from a cookie, and I'm
testing to see if the .user is tough enough)

Or maybe there is something else that can chop off the '.user' suffix?

Franklin DeMatto
franklinat_private
qDefense - DEFENDING THE ELECTRONIC FRONTIER

Next message: Rajkumar S.: "Re: Hijack IP Address using cable modem"
Previous message: Franklin DeMatto: "ssh crc32 exploit on Linux"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Sat Apr 28 2001 - 10:30:40 PDT