Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:
edgeos



Vulnerability Development: Re: shell script cgi

Re: shell script cgi

From: mlh <mlh_at_zip.com.au>
Date: Mon, 18 Nov 2002 21:02:07 +1100

c jones writes in part
>
> ua=`echo "$HTTP_USER_AGENT" | sed "s#\;##g"`
>

One thing that is odd about this scrap of code is
why one would bother removing the ';' yet leave
all sorts of other character sequences that are equally
meaningful to the shell, for instance &, &&, |, || etc.
Also ^ for older shells.

Matt
Received on Nov 18 2002

[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
edgeos