The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 12 

■

Attacking Other Users

407

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 407

---

■■

Some filters stop processing a string when they encounter a null byte,

even though the text following the null byte is still returned in the

application’s response. These filters can be bypassed by inserting a

URL-encoded null byte before the filtered expression. For example:

foo%00