WebApp Sec: Re: Universal PDF XSS Remediation (Fix)

[Tim Brown <tmb () 65535 com>]

Folks,

On an assessment at the moment and we have an opportunity to inject into a 
cookie.  The application however encodes our input using URL encoding.  Does 
any one know if there any way to exploit this?  Standard %0a %0d attacks 
won't work as % is reencoded as %25.

Cheers,
Tim
-- 
Tim Brown
<mailto:tmb () 65535 com>

-------------------------------------------------------------------------
Sponsored by: Watchfire

Securing a web application goes far beyond testing the application using 
manual processes, or by using automated systems and tools. Watchfire's 
"Web Application Security: Automated Scanning or Manual Penetration 
Testing?" whitepaper examines a few vulnerability detection methods - 
specifically comparing and contrasting manual penetration testing with 
automated scanning tools. Download it today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008fH6
--------------------------------------------------------------------------