Viewing Thread:
"Big IE Problem"

Stealing this off of someone else, but it's still quite interesting/worrying.

http://www.hodgeheg.demon.co.uk/1.html

Just by doing ~something~, you can trick IE into giving all the wrong details of the site you're on. This may be a dream for scanners.

That was a completely unintentional typo too, lucky I read over it...

Can't be bothered to change it back now..

more proof (as if it were needed) that IE sucks ass.
the sooner people switch to Mozilla, Opera or Firebird (what i'm using) the better. the fact that the Mozilla programs are free is an added bonus...

Read this: http://www.theregister.co.uk/content/55/34447.html

Aparently it;s only IE6 which does this, and from the tests Ive done, this seems to be right! Some interesting stuff in there about using HEX value URL's

Incidentally this behaviour can also be emulated easily with JavaScript.

http://www.microsoft.com
%[email protected]

It sends you to http://www.hodgeheg.demon.co.uk/, but sends you with *login information* that has username www.microsoft.com.

The http://username:[email protected]/ syntax is used for passing login information to protected pages in the URL. The
%00 is an exploit which screws up the rendering engine and makes it not show text after the
%00@ until \n.

I should imagine it affects all Windows platforms.

Lucky for me I use Safari ...

%00@

Which part of the source code causes that??

And it's damn simple to emulate... just look at the source code...

Wow!! you could have "welcome to LLoysdstsb please enter your details here" and all that...

The source code gives no clue must be the generator program...

I don't get it...