---
id: 519
title: "Null byte attacks are alive and well"
source_domain: portswigger.net
source_url: "https://portswigger.net/blog/null-byte-attacks-are-alive-and-well"
published_at: "2008-05-05T13:10:00Z"
tags: ["java", "web-security", "input-validation", "null-byte", "asp-net", "file-access"]
phying_url: "https://phying.com/item/519"
lang: en
---

# Null byte attacks are alive and well

## Summary

Null bytes still bypass validation because native code ends strings at the first zero byte while managed code does not: Java's .jpg filename check falls to %00, while ASP.NET rejects embedded nulls.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2008-05-05T13:10:00Z
- **Original:** https://portswigger.net/blog/null-byte-attacks-are-alive-and-well
- **Phying News:** https://phying.com/item/519