Other nomination

Lost in Translation (ASP's HomoXSSuality)

ma1

Classic ASP's Request() silently transliterates non-ASCII characters into the ASCII letters they resemble or sound like, an undocumented behaviour dropped in ASP.NET. A VBScript and JavaScript harness enumerated the full mapping table, finding three homoglyphs for '<' and five for the apostrophe, so a %u-escaped query string reaches the application as a working script tag and slips past anti-XSS filters and WAFs.

Record

Researcher

ma1

In the archive

• Nominated for the 2010 Top 10 Web Hacking Techniques

Tags

• unicode
• charset
• filter-bypass
• waf-bypass
• sanitizer-bypass
• xss
• sqli
• encoding
• owasp-a02-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of ma1, first published at the original source. Preserved copies are kept so the citation survives its host.