Questions tagged [unicode]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
4 votes
1 answer
185 views

Is there any benefit to normalize unicode/utf-8 names that I am overlooking?

Reading how Spotify was normalizing unicode inconsistently, and now I'm questioning if I am overlooking any issue on accepting non-normalized usernames. From what I can tell, lowercase was first used ...
gcb's user avatar
  • 223
1 vote
2 answers
160 views

Is OK to accept multibyte unicode codepoints as recipient address for Sendmail and Postfix?

I am working on a server software that receives an utf-8 encoded email address to send an email to. I permit multibyte unicode characters (emoji etc.). Then I pass that email address to Sendmail to ...
Greenlight's user avatar
0 votes
0 answers
494 views

Cracking UTF encoded hash using hashcat

I'm conducting tests using hashcat and find it very difficult if the hash is encoded. See the below function which takes the plain text, converts that to the bytes, creates the SHA512 hash and then ...
Brian Smith's user avatar
2 votes
2 answers
241 views

TOTP code with unicode character?

I was signing up for an app for a credit card I have and I encountered an SMS 2FA format I had never seen before. The code was 47𝞍⅗ Two digits, capital Phi, then the fraction three-fifths. To input, ...
Ken Y-N's user avatar
  • 121
0 votes
0 answers
312 views

Are "Pop Directional Formatting" and "Left-to-Right Override" unicode characters a possible exploit on NodeJS?

In a database table, I was running some phone number validations and I noticed that some unicode characters were inserted in a phone number field. The characters are: (U+202C): Pop Directional ...
Don't Mind Me's user avatar
10 votes
2 answers
2k views

Does CVE-2021-42694 affect only compiled code?

A new critical issue was discovered in the character definitions of the Unicode Specification through 14.0. Does it only affect code compiled from sources with disallowed unicode characters? RHEL ...
Michael's user avatar
  • 1,479
1 vote
1 answer
633 views

What are best practices for handling user Unicode in a web application?

Lately, the security community has been asking interesting questions around surprising side effects of raw Unicode formatting characters in source code. That got me thinking about input validation and ...
mrdecemberist's user avatar
24 votes
3 answers
4k views

Browser is accepting italic/bold Unicode as part of SPAM email's URL

This is truly crazy. I received a SPAM email in which there is a URL crafted from apparent Unicode characters that surprisingly exist for italic/bold letters, which when I reported it to Google's spam ...
asker13's user avatar
  • 351
1 vote
1 answer
154 views

Is there any way to get a unicode character that has a byte of 23?

I am pentesting a web application. It makes a backend call to another application, and I am trying to hijack that call. I have gained control over the URL path, query parameters, and fragment that is ...
Bob's user avatar
  • 89
0 votes
0 answers
130 views

Zero width character causing Javascript runtime error

On a particular page in this application, we have a form which allows for a very select few to input data into it, because at the end of the day (and, well, event loop) we end up wrappping that input ...
ruevaughn's user avatar
  • 123
2 votes
0 answers
1k views

XSS / SQL Injection Attacks with Character Encoding Mixups

Are there any character encoding mixup attacks that are still a threat in 2020? Such as with XSS or SQL injection being the most obvious. Some examples: Tricking a browser to display a page in UTF-...
ansichart's user avatar
  • 797
0 votes
0 answers
147 views

Is there a list of Unicode symbols that matches ASCII when lowercased (in java)?

Say we have a server-side code does a whitelist validation of allowed file extensions when user uploads a file: // Java code if (allowedExtensionsInLowercase.contains(fileExtension.toLowerCase())) { ...
Xenos's user avatar
  • 1,381
1 vote
2 answers
244 views

Is UTF-8 malleable?

I've got two byte sequences, and I decode them as UTF-8 (in strict mode to be sure they're valid UTF-8). Is it correct to assume that, if the bytes are different, the decoded codepoints will also be ...
Alba Mendez's user avatar
7 votes
1 answer
4k views

Why do so many spam emails lately contain a lot of unicode characters?

I receive a lot of spam email (probably from recent breaches). A lot of them contain text that looks a lot like the below text: Why do they contain such weird characters? Is this part of an exploit? ...
Nzall's user avatar
  • 7,433
1 vote
1 answer
470 views

Encoding ASCII character as three-byte UTF-8. How does it work?

I'm reading a report on HackerOne https://hackerone.com/reports/52042. An input filter was bypassed by sending %E5%98%8A that was then parsed as 0x0A character (new line). The %E5%98%8A sequence ...
Alex Velickiy's user avatar
2 votes
3 answers
2k views

Is it risky to URL-encode characters in an already URL-encoded string?

I'm maintaining a legacy web application which is composed of the application itself, accessible to the public, and the REST services which can be accessed only by the application through the LAN. At ...
Arseni Mourzenko's user avatar
7 votes
1 answer
17k views

Generating unicode javascript shellcode

I'm trying to generate shellcode to modify this exploit: https://www.exploit-db.com/exploits/24947/ It says in the basic exploit: {'$where':'shellcode=unescape("METASPLOIT JS GENERATED SHELLCODE"); ...
user134167's user avatar
18 votes
3 answers
4k views

How to defend against homograph attacks?

Referring to this Wikipedia example of an homograph attack, the URL of Wikipedia had the Latin characters A and E replaced with a similar Cyrillic copy (wikipediа.org). These characters look so ...
toffee.beanns's user avatar
4 votes
0 answers
2k views

Whatsapp Unicode Phishing Link [closed]

I have been receiving messages from relatives that goes like this: AirAsia is rewarding everyone with 2 free plane tickets to celebrate 24 Years of quality service. Get your free ticket at: http://...
Liren Yeo's user avatar
  • 141
60 votes
14 answers
19k views

Is it a good idea to use the entire Unicode range to generate a random password rather than limited ranges? [duplicate]

I know for a fact that some sites/apps with low security restrict passwords to alphanumeric characters only, and some allow a slightly broader ASCII range. Some sites/apps also support Unicode. ...
person of entropy's user avatar
1 vote
1 answer
2k views

Hacked: Can a UTF-8 encoded script execute non-UTF-8 characters?

To be honest, I'm not really sure the best title for this question, or the full scope of it, but the motivation behind it is: Motivation Assume your server was hacked, you open up your UTF-8 encoded ...
Timothy L.J. Stewart's user avatar
0 votes
1 answer
269 views

Recover UTF16 Strings from Slack Space

Using the disk image provided by the CFReDS project here, we are tasked with recovering deleted text, much in Russian, some in English, in UTF16BE. In the allocated space, this goes relatively quickly ...
d-cubed's user avatar
  • 105
28 votes
2 answers
47k views

List of visually similar characters, for detecting spoofing and social engineering attacks

I'm trying to detect homograph attacks and other attacks where an attacker uses a spoof domain name that looks visually similar to a trusted domain name (e.g., bankofthevvest.com instead of ...
D.W.'s user avatar
  • 99.5k
1 vote
0 answers
296 views

Oracle PL/SQL SQL Injection Test from Unicode to Windows-1252

I have a DB using windows-1252 character encoding and dynamic SQL that does simple single quote escaping like this... l_str := REPLACE(TRIM(someUserInput),'''',''''''); Because the DB is windows-...
gfrobenius's user avatar
1 vote
0 answers
2k views

gpg 2.0 command line option to create UTF-8 data

With echo text | gpg2 --sign --textmode -a I can create messages with a one pass signature containing a Literal Data packet in TEXT ('t') format. If I skip the --textmode option it will generate ...
eckes's user avatar
  • 982
2 votes
1 answer
2k views

All UTF-8 characters for generated passwords

Why do a lot of password generators don't generate strong passwords including chinese, arabian...-characters? All generators I saw, also the included one in my password manager keepass, just output ...
user3147268's user avatar
12 votes
5 answers
12k views

Should a website limit characters that can be entered in its fields?

I got into a (somewhat heated) discussion with my colleague today about what characters our application should accept. This was prompted by the discovery that you can enter anything in the search box ...
Vilx-'s user avatar
  • 1,030
1 vote
1 answer
554 views

Minimum SHA256'd UTF8 encoded passphrase length not stored anywhere

For a passphrase that is UTF8 encoded and then SHA256'd, what is the minimum length to achieve a practically collision free result? The implementation is for a 32 byte cryptocurrency ed25519 seed ...
user avatar
4 votes
4 answers
19k views

SQL Injection via Unicode

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
Cyassin's user avatar
  • 515
11 votes
2 answers
3k views

PHP: if charset mismatches (htmlentities UTF-8) viewed by client as ISO-8859-1 (or vice versa)

Short Question: Question: Could any security vulnerabilities arise if a server runs htmlentities as UTF-8 but the client views the results as ISO-8859-1? Assumption: No vulnerabilities exist when ...
dajon's user avatar
  • 211
12 votes
3 answers
1k views

Is it okay to normalize unicode passwords with NFC/NFD?

I am currently designing a login for a web service. I will use a PBKDF2 implementation for hashing the passwords. However, I intend to allow unicode for passwords, as I will have international users, ...
Jonas Schäfer's user avatar
18 votes
1 answer
22k views

Why does Directory traversal attack %C0%AF work?

Introduction: I am trying to learn the basics of Directory Traversal. Question: While trying to understand the 2-Byte Unicode conversion of characters, I came across this_SANS ARTICLE that explains ...
DA12C 917's user avatar
  • 318
9 votes
3 answers
8k views

Is there a dictionary of visibly similar Unicode characters for Spam processing?

I have spam that looks like this: мy вυddy'ѕ мoм мαĸeѕ $74/нoυr oɴ тнe lαpтop. ѕнe нαѕ вeeɴ lαιd oғғ ғor ѕeveɴ мoɴтнѕ вυт lαѕт мoɴтн нer pαy cнecĸ wαѕ $19420 jυѕт worĸιɴɢ oɴ тнe lαpтop ғor α ...
makerofthings7's user avatar
3 votes
1 answer
5k views

XSS via Unicode

Reading about XSS and its countermeasures from http://www.xssed.com/xssinfo#Avoiding_XSS_vulnerabilities , it says (in the 2nd last paragraph of the link) that: […] support for Unicode character ...
Karan's user avatar
  • 467
14 votes
3 answers
12k views

Is there a way to bypass Django's XSS escaping with "unicode"?

Django (the Python web framework) escapes output to prevent XSS (Cross Site Scripting) attacks. It replaces ', ", <, >, & with their HTML safe versions. However this presentation on slide ...
Amandasaurus's user avatar
6 votes
2 answers
2k views

What exploit types do I need to protect against in PHP?

I recently learned that it is common for people to attempt SQL injections using the HTTP referrer in PHP. What other inputs do I need to protect against? I am currently "cleaning up" incoming $_GET[]...
Frank E's user avatar
  • 113
3 votes
2 answers
367 views

How to defend against invalid UTF7/8 that hides a <script> tag?

I'm scanning HTML before it reaches a browser, and I've just heard about a type of exploit that uses invalid UTF7 or UTF8 sequences to embed an otherwise invisible script tag, which is used to execute ...
Rufus's user avatar
  • 31
22 votes
4 answers
14k views

How did Anonymous use UTF-16 ASCII to fool PHP escaping?

A few months ago, Anonymous took down a child pornography site using SQL-injection. I read in this article that Anonymous claimed that "the server was using hardened PHP with escaping," but they were ...
Nate Glenn's user avatar
11 votes
3 answers
3k views

White list or black list sanitation for international input?

There seem to be so many ways to create nefarious input that white-listing what input is good usually feels like the safer, simpler option. For instance, one can fairly easily craft a white list ...
jaketrent's user avatar
  • 213
5 votes
2 answers
427 views

What applications are at risk from "Backwards Unicode Names" and what are the mitigations?

There is a vulnerability where some applications (such as explorer.exe) respond to Unicode characters that change the direction of the text (right-to-left vs left-to-right). This may be used to mask ...
makerofthings7's user avatar