IE9 Self-XSS black box protection function Bypass

It's boring to get bored... turn a post and think it's fun.-_-English is not very good. translation is not very good. Don't blame me... you can understand it. The source is http://soroush.secproject.com/blog/2012/08/ie9-self-xss-blackbox-protection-bypass/ . -==================================== Dear split line ===================== ======================== To Be Honest, self-xss does not know how to translate. Personally, it is similar to javascript in the address bar: similar pseudo protocols... in IE9. for the sake of security, MS will remove the previous protocol .. for example, if you try to input javascript: alert (1) in the address bar, it is actually alert (1). In the latest version, this mechanism of IE can still find some protocols starting with special characters... For example, 0x20 and Control Characters (0 × 00-0x1F-not 0 × 00 and 0x7F), and Colon (0x3A) (Google chrome is currently vulnerable to this http://code.google.com/p/chromium/issues/detail?id=123213 ). Therefore, even if you encrypt javascript: // once, it will still be recognized and removed .. For example, try % 01% 02% 03% 04% 05% 06% 07% 08% 09% 0A % 0B % 0C % 0D % 0E % 0F % 10% 11% 12% 13% 14% 15% 16% 17% 18% 1A % 1B. % 1C % 1D % 1E % 1F % 3A % 20 javascript: alert (1) .. in IE, there is a special protocol, that is, file: // 1-add any letter before the Protocol, for example (e.g. "Xfile:"), or add up to 3 arbitrary letters (e.g. "fileXXX:"), or add one (e.g. "XfileX:") 2-Next, add any characters after the colon that are more than urlencode... (E.g. "XfileX: % 20% 0A % 1F") 3-then enter javascript: alert (1 ).... (e.g. "XfileX: % 20% 0A % 1F javascript: Your Code Here ". 4-open a website like renren.com www.2cto.com 5 at Will-copy the code to the address bar... press enter (e.g. "XfileX: % 20% 0A % 1 Fjavascript: alert (document. cookie) ") 6-You should see the cookie of the pop-up renren! Two simple exp: Filexx: % 09 javascript: alert (1) xfile: % 20 vbscript: msgbox (1) the following exp can work in IE of different versions... the author did not specify the version. run XfileX: c:/XfileX: % windir % .... this sentence is not translated ~