New comment by picklemorty in "XSS attacks on Googlebot allow search index manipulation"

picklemorty — Fri, 19 Jul 2019 14:04:39 +0000

Was the first I was thinking

java.net.URI.create Illegal Chars and Safari

picklemorty — Thu, 11 Jul 2019 08:15:26 +0000

I saw URI.create complaining about illegal chars and thought maybe I can trigger such errors with Safari, as it allows many special chars in subdomains.

These worked:

, & ' ; ! $ * ( ) + = ~ - _ = %01 %02 %03 %04 %05 %06 %07 %08 %0b %0c %0e %0f %10 %11 %12 %13 %14 %15 %16 %17 %18 %19 %1a %1b %1c %1d %1e %1f %7f

Comments URL: https://news.ycombinator.com/item?id=20409943

Points: 2

# Comments: 0

Hacker News: picklemorty

New comment by picklemorty in "XSS attacks on Googlebot allow search index manipulation"

java.net.URI.create Illegal Chars and Safari