Other nomination

JSON Hijacking with UTF-7

Yosuke Hasegawa

POC2008 deck surveying attacks that live in character encoding: overlong UTF-8, many-to-one Unicode conversion and post-validation normalisation reopening path traversal, invalid and lead bytes bypassing filters including IE8's XSS filter, and UTF-7 XSS wherever charset is absent or unrecognised.

Record

Researcher

Yosuke Hasegawa

Format

Slides

In the archive

• Nominated for the 2008 Top 10 Web Hacking Techniques

Tags

• charset
• unicode
• encoding
• xss
• filter-bypass
• parser-differential
• path-traversal
• url-spoofing
• owasp-a01-2021
• owasp-a02-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Yosuke Hasegawa, first published at the original source. Preserved copies are kept so the citation survives its host.