Questions tagged [unicode]
The unicode tag has no usage guidance.
40
questions
4
votes
1
answer
109
views
Is there any benefit to normalize unicode/utf-8 names that I am overlooking?
Reading how Spotify was normalizing unicode inconsistently, and now I'm questioning if I am overlooking any issue on accepting non-normalized usernames.
From what I can tell, lowercase was first used ...
- 213
0
votes
2
answers
59
views
Is OK to accept multibyte unicode codepoints as recipient address for Sendmail and Postfix?
I am working on a server software that receives an utf-8 encoded email address to send an email to.
I permit multibyte unicode characters (emoji etc.). Then I pass that email address to Sendmail to ...
0
votes
0
answers
341
views
Cracking UTF encoded hash using hashcat
I'm conducting tests using hashcat and find it very difficult if the hash is encoded.
See the below function which takes the plain text, converts that to the bytes, creates the SHA512 hash and then ...
1
vote
1
answer
154
views
TOTP code with unicode character?
I was signing up for an app for a credit card I have and I encountered an SMS 2FA format I had never seen before. The code was 47𝞍⅗ - that is two digits then capital Phi then the fraction three-...
- 111
0
votes
0
answers
196
views
Are "Pop Directional Formatting" and "Left-to-Right Override" unicode characters a possible exploit on NodeJS?
In a database table, I was running some phone number validations and I noticed that some unicode characters were inserted in a phone number field.
The characters are:
(U+202C): Pop Directional ...
10
votes
2
answers
2k
views
Does CVE-2021-42694 affect only compiled code?
A new critical issue was discovered in the character definitions of the Unicode Specification through 14.0.
Does it only affect code compiled from sources with disallowed unicode characters?
RHEL ...
- 1,479
0
votes
1
answer
389
views
What are best practices for handling user Unicode in a web application?
Lately, the security community has been asking interesting questions around surprising side effects of raw Unicode formatting characters in source code. That got me thinking about input validation and ...
- 123
24
votes
3
answers
4k
views
Browser is accepting italic/bold Unicode as part of SPAM email's URL
This is truly crazy. I received a SPAM email in which there is a URL crafted from apparent Unicode characters that surprisingly exist for italic/bold letters, which when I reported it to Google's spam ...
- 351
1
vote
1
answer
126
views
Is there any way to get a unicode character that has a byte of 23?
I am pentesting a web application. It makes a backend call to another application, and I am trying to hijack that call.
I have gained control over the URL path, query parameters, and fragment that is ...
- 79
0
votes
0
answers
112
views
Zero width character causing Javascript runtime error
On a particular page in this application, we have a form which allows for a very select few to input data into it, because at the end of the day (and, well, event loop) we end up wrappping that input ...
- 123
1
vote
0
answers
1k
views
XSS / SQL Injection Attacks with Character Encoding Mixups
Are there any character encoding mixup attacks that are still a threat in 2020? Such as with XSS or SQL injection being the most obvious.
Some examples:
Tricking a browser to display a page in UTF-...
- 777
0
votes
0
answers
121
views
Is there a list of Unicode symbols that matches ASCII when lowercased (in java)?
Say we have a server-side code does a whitelist validation of allowed file extensions when user uploads a file:
// Java code
if (allowedExtensionsInLowercase.contains(fileExtension.toLowerCase())) {
...
- 1,351
1
vote
2
answers
212
views
Is UTF-8 malleable?
I've got two byte sequences, and I decode them as UTF-8 (in strict mode to be sure they're valid UTF-8).
Is it correct to assume that, if the bytes are different, the decoded codepoints will also be ...
- 121
5
votes
1
answer
4k
views
Why do so many spam emails lately contain a lot of unicode characters?
I receive a lot of spam email (probably from recent breaches). A lot of them contain text that looks a lot like the below text:
Why do they contain such weird characters? Is this part of an exploit? ...
- 7,413
1
vote
1
answer
417
views
Encoding ASCII character as three-byte UTF-8. How does it work?
I'm reading a report on HackerOne https://hackerone.com/reports/52042.
An input filter was bypassed by sending %E5%98%8A that was then parsed as 0x0A character (new line).
The %E5%98%8A sequence ...
- 211
2
votes
3
answers
1k
views
Is it risky to URL-encode characters in an already URL-encoded string?
I'm maintaining a legacy web application which is composed of the application itself, accessible to the public, and the REST services which can be accessed only by the application through the LAN. At ...
- 4,724
7
votes
1
answer
17k
views
Generating unicode javascript shellcode
I'm trying to generate shellcode to modify this exploit:
https://www.exploit-db.com/exploits/24947/
It says in the basic exploit:
{'$where':'shellcode=unescape("METASPLOIT JS GENERATED SHELLCODE");
...
- 171
16
votes
3
answers
3k
views
How to defend against homograph attacks?
Referring to this Wikipedia example of an homograph attack, the URL of Wikipedia had the Latin characters A and E replaced with a similar Cyrillic copy (wikipediа.org). These characters look so ...
- 291
4
votes
0
answers
2k
views
Whatsapp Unicode Phishing Link [closed]
I have been receiving messages from relatives that goes like this:
AirAsia is rewarding everyone with 2 free plane tickets to celebrate 24 Years of quality service. Get your free ticket at: http://...
- 141
59
votes
14
answers
18k
views
Is it a good idea to use the entire Unicode range to generate a random password rather than limited ranges? [duplicate]
I know for a fact that some sites/apps with low security restrict passwords to alphanumeric characters only, and some allow a slightly broader ASCII range. Some sites/apps also support Unicode.
...
1
vote
1
answer
1k
views
Hacked: Can a UTF-8 encoded script execute non-UTF-8 characters?
To be honest, I'm not really sure the best title for this question, or the full scope of it, but the motivation behind it is:
Motivation
Assume your server was hacked, you open up your UTF-8 encoded ...
0
votes
1
answer
247
views
Recover UTF16 Strings from Slack Space
Using the disk image provided by the CFReDS project here, we are tasked with recovering deleted text, much in Russian, some in English, in UTF16BE. In the allocated space, this goes relatively quickly ...
- 105
28
votes
2
answers
46k
views
List of visually similar characters, for detecting spoofing and social engineering attacks
I'm trying to detect homograph attacks and other attacks where an attacker uses a spoof domain name that looks visually similar to a trusted domain name (e.g., bankofthevvest.com instead of ...
- 99.3k
1
vote
0
answers
272
views
Oracle PL/SQL SQL Injection Test from Unicode to Windows-1252
I have a DB using windows-1252 character encoding and dynamic SQL that does simple single quote escaping like this...
l_str := REPLACE(TRIM(someUserInput),'''','''''');
Because the DB is windows-...
- 111
1
vote
0
answers
2k
views
gpg 2.0 command line option to create UTF-8 data
With echo text | gpg2 --sign --textmode -a I can create messages with a one pass signature containing a Literal Data packet in TEXT ('t') format.
If I skip the --textmode option it will generate ...
- 972
2
votes
1
answer
2k
views
All UTF-8 characters for generated passwords
Why do a lot of password generators don't generate strong passwords including chinese, arabian...-characters? All generators I saw, also the included one in my password manager keepass, just output ...
- 745
12
votes
5
answers
11k
views
Should a website limit characters that can be entered in its fields?
I got into a (somewhat heated) discussion with my colleague today about what characters our application should accept. This was prompted by the discovery that you can enter anything in the search box ...
- 1,020
1
vote
1
answer
527
views
Minimum SHA256'd UTF8 encoded passphrase length not stored anywhere
For a passphrase that is UTF8 encoded and then SHA256'd, what is the minimum length to achieve a practically collision free result?
The implementation is for a 32 byte cryptocurrency ed25519 seed ...
user36556
4
votes
4
answers
19k
views
SQL Injection via Unicode
My team currently uses ASP.NET with MS SQL Server for our software.
Security has only become important since I started, in which there is injection vulnerabilities everywhere.
Due to current ...
- 513
11
votes
2
answers
3k
views
PHP: if charset mismatches (htmlentities UTF-8) viewed by client as ISO-8859-1 (or vice versa)
Short Question:
Question: Could any security vulnerabilities arise if a server runs htmlentities as UTF-8 but the client views the results as ISO-8859-1?
Assumption: No vulnerabilities exist when ...
- 211
11
votes
3
answers
1k
views
Is it okay to normalize unicode passwords with NFC/NFD?
I am currently designing a login for a web service. I will use a PBKDF2 implementation for hashing the passwords.
However, I intend to allow unicode for passwords, as I will have international users, ...
- 209
18
votes
1
answer
21k
views
Why does Directory traversal attack %C0%AF work?
Introduction: I am trying to learn the basics of Directory Traversal.
Question: While trying to understand the 2-Byte Unicode conversion of characters, I came across this_SANS ARTICLE that explains ...
- 318
9
votes
3
answers
8k
views
Is there a dictionary of visibly similar Unicode characters for Spam processing?
I have spam that looks like this:
мy вυddy'ѕ мoм мαĸeѕ $74/нoυr oɴ тнe lαpтop. ѕнe нαѕ вeeɴ lαιd oғғ ғor
ѕeveɴ мoɴтнѕ вυт lαѕт мoɴтн нer pαy cнecĸ wαѕ $19420 jυѕт worĸιɴɢ oɴ
тнe lαpтop ғor α ...
- 50.6k
3
votes
1
answer
5k
views
XSS via Unicode
Reading about XSS and its countermeasures from http://www.xssed.com/xssinfo#Avoiding_XSS_vulnerabilities , it says (in the 2nd last paragraph of the link) that:
[…] support for Unicode character ...
- 467
13
votes
3
answers
12k
views
Is there a way to bypass Django's XSS escaping with "unicode"?
Django (the Python web framework) escapes output to prevent XSS (Cross Site Scripting) attacks. It replaces ', ", <, >, & with their HTML safe versions.
However this presentation on slide ...
- 231
6
votes
2
answers
2k
views
What exploit types do I need to protect against in PHP?
I recently learned that it is common for people to attempt SQL injections using the HTTP referrer in PHP. What other inputs do I need to protect against?
I am currently "cleaning up" incoming $_GET[]...
- 113
3
votes
2
answers
357
views
How to defend against invalid UTF7/8 that hides a <script> tag?
I'm scanning HTML before it reaches a browser, and I've just heard about a type of exploit that uses invalid UTF7 or UTF8 sequences to embed an otherwise invisible script tag, which is used to execute ...
- 31
22
votes
4
answers
14k
views
How did Anonymous use UTF-16 ASCII to fool PHP escaping?
A few months ago, Anonymous took down a child pornography site using SQL-injection. I read in this article that Anonymous claimed that "the server was using hardened PHP with escaping," but they were ...
- 333
11
votes
3
answers
3k
views
White list or black list sanitation for international input?
There seem to be so many ways to create nefarious input that white-listing what input is good usually feels like the safer, simpler option.
For instance, one can fairly easily craft a white list ...
- 213
5
votes
2
answers
407
views
What applications are at risk from "Backwards Unicode Names" and what are the mitigations?
There is a vulnerability where some applications (such as explorer.exe) respond to Unicode characters that change the direction of the text (right-to-left vs left-to-right). This may be used to mask ...
- 50.6k