Welcome to HBH! If you had an account on hellboundhacker.org you will need to reset your password using the Lost Password system before you will be able to login.

The null byte upload attack on newer browsers?

  1. Home
  2. Forum
  3. Web hacking
  4. The null byte upload attack on newer browsers?

Mb0742's Avatar

Mb0742

Ultimate Headshot
0 0

Anyway to do it when file uploading? Opera just says '[x]%00[y] not found'


Tucak's Avatar

Tucak

Member
0 0

I have tried it with Firefox, and it looks like that the filename parameter is not encoded. Edit: Also tried it with a real null-byte, but php used only what's before the null-byte.


Mb0742's Avatar

Mb0742

Ultimate Headshot
0 0

Is this a test preformed by you on your own code? If so you reckon that the newest php amendment has automatically fixed this with the inclusion of sanitize() etc.?


ghost's Avatar

ghost

0 0

Out of interest have you tried \x00 instead?


spyware's Avatar

spyware

Banned
0 0

If you think the browser is screwing with your input, bypass it by doing a direct(er) request using sockets/some API in the language of your choice.


ghost's Avatar

ghost

0 0

spyware wrote: If you think the browser is screwing with your input, bypass it by doing a direct(er) request using sockets/some API in the language of your choice.

Live Http Headers will do.