PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bypassing character blocklists with unicode overflows

portswigger.net | research | #burp-suite | #web-security | #unicode | #filter-bypass | #character-encoding | #truncation
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Unicode codepoint truncation turns overflow values into blocked ASCII characters — 0x4e41 % 256 yields 'A' — bypassing character blocklists; the trick now ships in ActiveScan++ and Hackvertor.
Published
Collected

Related coverage

research · portswigger.net
Cookie Chaos: How to bypass __Host and __Secure cookie prefixes
Unicode whitespace bypasses __Host- and __Secure- cookie prefixes: browsers treat the cookie as unrestricted, but servers such as Django and ASP.NET trim the character and honour the protected name.
research · portswigger.net
Practical Web Cache Poisoning
James Kettle's whitepaper shows how to turn web caches into exploit delivery systems, hijacking JavaScript and poisoning responses across popular sites, plus defenses and open source tooling.
research · portswigger.net
Splitting the email atom: exploiting parsers to bypass access controls
Email parser discrepancies — quoted values, Unicode overflows, encoded-word, malformed Punycode — become access control bypasses and RCE, with cases against GitHub, Zendesk, GitLab and Joomla.
research · portswigger.net
Unearthing Z͌̈́̾a͊̈́l͊̿g̏̉͆o̾̚̚S̝̬ͅc̬r̯̼͇ͅi̼͖̜̭͔p̲̘̘̹͖t̠͖̟̹͓͇ͅ with visual fuzzing
Gareth Heyes uses visual fuzzing with headless Chrome and puppeteer to hunt Unicode combining characters that form render-defect Zalgo JavaScript, valid on Edge.
research · portswigger.net
Executing non-alphanumeric JavaScript without parenthesis
Gareth Heyes executes non-alphanumeric JavaScript without parentheses by abusing template literals and Array.prototype.find, building filter-evading XSS payloads that previously helped hack Uber.
research · portswigger.net
Bypassing CSP using polyglot JPEGs
Gareth Heyes shows how to build a polyglot JavaScript/JPEG that remains a valid image yet executes as script, bypassing CSP on sites that host user-uploaded images on the same domain.
Back