Questions tagged [unicode]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
2answers
140 views

Is UTF-8 malleable?

I've got two byte sequences, and I decode them as UTF-8 (in strict mode to be sure they're valid UTF-8). Is it correct to assume that, if the bytes are different, the decoded codepoints will also be ...
1
vote
1answer
129 views

Why do so many spam emails lately contain a lot of unicode characters?

I receive a lot of spam email (probably from recent breaches). A lot of them contain text that looks a lot like the below text: Why do they contain such weird characters? Is this part of an exploit? ...
1
vote
1answer
120 views

Encoding ASCII character as three-byte UTF-8. How does it work?

I'm reading a report on HackerOne https://hackerone.com/reports/52042. An input filter was bypassed by sending %E5%98%8A that was then parsed as 0x0A character (new line). The %E5%98%8A sequence ...
2
votes
3answers
216 views

Is it risky to URL-encode characters in an already URL-encoded string?

I'm maintaining a legacy web application which is composed of the application itself, accessible to the public, and the REST services which can be accessed only by the application through the LAN. At ...
0
votes
1answer
5k views

Generating unicode javascript shellcode

I'm trying to generate shellcode to modify this exploit: https://www.exploit-db.com/exploits/24947/ It says in the basic exploit: {'$where':'shellcode=unescape("METASPLOIT JS GENERATED SHELLCODE"); ...
16
votes
3answers
2k views

How to defend against homograph attacks?

Referring to this Wikipedia example of an homograph attack, the URL of Wikipedia had the Latin characters A and E replaced with a similar Cyrillic copy (wikipediа.org). These characters look so ...
4
votes
0answers
2k views

Whatsapp Unicode Phishing Link [closed]

I have been receiving messages from relatives that goes like this: AirAsia is rewarding everyone with 2 free plane tickets to celebrate 24 Years of quality service. Get your free ticket at: http://...
55
votes
14answers
12k views

Is it a good idea to use the entire Unicode range to generate a random password rather than limited ranges? [duplicate]

I know for a fact that some sites/apps with low security restrict passwords to alphanumeric characters only, and some allow a slightly broader ASCII range. Some sites/apps also support Unicode. ...
1
vote
1answer
628 views

Hacked: Can a UTF-8 encoded script execute non-UTF-8 characters?

To be honest, I'm not really sure the best title for this question, or the full scope of it, but the motivation behind it is: Motivation Assume your server was hacked, you open up your UTF-8 encoded ...
0
votes
1answer
119 views

Recover UTF16 Strings from Slack Space

Using the disk image provided by the CFReDS project here, we are tasked with recovering deleted text, much in Russian, some in English, in UTF16BE. In the allocated space, this goes relatively quickly ...
19
votes
2answers
21k views

List of visually similar characters, for detecting spoofing and social engineering attacks

I'm trying to detect homograph attacks and other attacks where an attacker uses a spoof domain name that looks visually similar to a trusted domain name (e.g., bankofthevvest.com instead of ...
1
vote
0answers
147 views

Oracle PL/SQL SQL Injection Test from Unicode to Windows-1252

I have a DB using windows-1252 character encoding and dynamic SQL that does simple single quote escaping like this... l_str := REPLACE(TRIM(someUserInput),'''',''''''); Because the DB is windows-...
1
vote
0answers
922 views

gpg 2.0 command line option to create UTF-8 data

With echo text | gpg2 --sign --textmode -a I can create messages with a one pass signature containing a Literal Data packet in TEXT ('t') format. If I skip the --textmode option it will generate ...
2
votes
1answer
1k views

All UTF-8 characters for generated passwords

Why do a lot of password generators don't generate strong passwords including chinese, arabian...-characters? All generators I saw, also the included one in my password manager keepass, just output ...
12
votes
5answers
7k views

Should a website limit characters that can be entered in its fields?

I got into a (somewhat heated) discussion with my colleague today about what characters our application should accept. This was prompted by the discovery that you can enter anything in the search box ...
1
vote
1answer
385 views

Minimum SHA256'd UTF8 encoded passphrase length not stored anywhere

For a passphrase that is UTF8 encoded and then SHA256'd, what is the minimum length to achieve a practically collision free result? The implementation is for a 32 byte cryptocurrency ed25519 seed ...
4
votes
4answers
13k views

SQL Injection via Unicode

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
11
votes
2answers
2k views

PHP: if charset mismatches (htmlentities UTF-8) viewed by client as ISO-8859-1 (or vice versa)

Short Question: Question: Could any security vulnerabilities arise if a server runs htmlentities as UTF-8 but the client views the results as ISO-8859-1? Assumption: No vulnerabilities exist when ...
9
votes
1answer
721 views

Is it okay to normalize unicode passwords with NFC/NFD?

I am currently designing a login for a web service. I will use a PBKDF2 implementation for hashing the passwords. However, I intend to allow unicode for passwords, as I will have international users, ...
12
votes
1answer
9k views

Why does Directory traversal attack %C0%AF work?

Introduction: I am trying to learn the basics of Directory Traversal. Question: While trying to understand the 2-Byte Unicode conversion of characters, I came across this_SANS ARTICLE that explains ...
7
votes
2answers
4k views

Is there a dictionary of visibly similar Unicode characters for Spam processing?

I have spam that looks like this: мy вυddy'ѕ мoм мαĸeѕ $74/нoυr oɴ тнe lαpтop. ѕнe нαѕ вeeɴ lαιd oғғ ғor ѕeveɴ мoɴтнѕ вυт lαѕт мoɴтн нer pαy cнecĸ wαѕ $19420 jυѕт worĸιɴɢ oɴ тнe lαpтop ғor α ...
3
votes
1answer
3k views

XSS via Unicode

Reading about XSS and its countermeasures from http://www.xssed.com/xssinfo#Avoiding_XSS_vulnerabilities , it says (in the 2nd last paragraph of the link) that: […] support for Unicode character ...
12
votes
3answers
8k views

Is there a way to bypass Django's XSS escaping with “unicode”?

Django (the Python web framework) escapes output to prevent XSS (Cross Site Scripting) attacks. It replaces ', ", <, >, & with their HTML safe versions. However this presentation on slide ...
5
votes
2answers
2k views

What exploit types do I need to protect against in PHP?

I recently learned that apparently, it is common for people to attempt SQL injections using the HTTP referrer in PHP. What other inputs do I need to protect against? I am currently "cleaning up" ...
3
votes
2answers
292 views

How to defend against invalid UTF7/8 that hides a <script> tag?

I'm scanning HTML before it reaches a browser, and I've just heard about a type of exploit that uses invalid UTF7 or UTF8 sequences to embed an otherwise invisible script tag, which is used to execute ...
21
votes
4answers
12k views

How did Anonymous use UTF-16 ASCII to fool PHP escaping?

A few months ago, Anonymous took down a child pornography site using SQL-injection. I read in this article that Anonymous claimed that "the server was using hardened PHP with escaping," but they were ...
11
votes
3answers
2k views

White list or black list sanitation for international input?

There seem to be so many ways to create nefarious input that white-listing what input is good usually feels like the safer, simpler option. For instance, one can fairly easily craft a white list ...
5
votes
2answers
317 views

What applications are at risk from “Backwards Unicode Names” and what are the mitigations?

There is a vulnerability where some applications (such as explorer.exe) respond to Unicode characters that change the direction of the text (right-to-left vs left-to-right). This may be used to mask ...