Vulnerability Development: RE: help:// protocol in Windows XP Prof

["Weltha, Nick [ADM]" <nickw () iastate edu>]

Another oddity is typing something like "tesee://google.com" then
hitting enter in the status bar will pop up a telnet connection to
Google. I believe it just arbitrarily decides what the best protocol is
for what you write.

Nick Weltha
Systems 
Office of Admissions
310 Alumni Hall 
Iowa State University 
Ames, IA 50011 
PH: 515.294.3612 
FAX: 515.294.6106 
nickw () iastate edu 


-----Original Message-----
From: Derek Kwan [mailto:Derek () Kwan ca] 
Sent: Wednesday, July 07, 2004 5:58 PM
To: vuln-dev () securityfocus com
Subject: Re: help:// protocol in Windows XP Prof

In fact, you can try any h{a-z}{a-z}p://  will work...

D

<Quote> Bartosz Kwitkowski</Quote>
>  There is funny thing in Internet Explorer 6.0 - Windows XP
Professional
> (fully patched).
>
>  When you are writing address in IE you can replace http:// by help://
>
>  example:
>
>  http://wb.pl/bartosz = help://wb.pl/bartosz
>
> and than hit <ENTER>... Page will open...
>
>  other...
>
>  help://www.securityfocus.com - looks funny, isn't? :-)
>
>  when IE opens page changes help:// to http://
>
>  BUT, BUT,
>
>  when you are create hyperlink <a
href="help://wb.pl/bartosz">check</a>
>  it won't work - IE says syntax error...
>
>  I'm trying to exploit this...
>
>  Best regards,
>  Bartosz Kwitkowski