Alper Kaya alperkaya0

Unicode XSS via Combining Characters

Most application security practitioners are familiar with Unicode XSS, which typically arises from the Unicode character fullwidth-less-than-sign. It’s not a common vulnerability but does occasionally appear in applications that otherwise have good XSS protection. In this blog I describe another variant of Unicode XSS that I have identified, using combining characters. I’ve not observed this in the wild, so it’s primarily of theoretical concern. But the scenario is not entirely implausible and I’ve not otherwise seen this technique discussed, so I hope this is useful.

Recap of Unicode XSS

Lab: https://4t64ubva.xssy.uk/

A quick investigation of the lab shows that it is echoing the name parameter, and performing HTML escaping:

Run like

> decode_saml_request.sh sample_data

Install Deepin Desktop Environment In Arch or Manjaro

I recommend doing this as a net/minimum install with Manjaro (no desktop manager attached with the install).

Update sources & packages

pacman -Syu
reboot -h now

	using System;
	using System.Linq;
	using MongoDB.Bson;

	namespace Extensions
	{
	internal static class BsonToGuid
	{
	internal static Guid AsGuid(this BsonObjectId oid)
	{

	# PowerView's last major overhaul is detailed here: http://www.harmj0y.net/blog/powershell/make-powerview-great-again/
	# tricks for the 'old' PowerView are at https://gist.github.com/HarmJ0y/3328d954607d71362e3c

	# the most up-to-date version of PowerView will always be in the dev branch of PowerSploit:
	# https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1

	# New function naming schema:
	# Verbs:
	# Get : retrieve full raw data sets
	# Find : ‘find’ specific data entries in a data set

	#!/usr/bin/sudo ruby

	#
	# revealer.rb -- Deobfuscate GHE .rb files.
	#
	# This is simple:
	# Every obfuscated file in the GHE VM contains the following code:
	#
	# > require "ruby_concealer.so"
	# > __ruby_concealer__ "..."

	# additions on 10/31/2013:
	fazadhili
	andrethunder
	bmangin
	polkaros
	itirkkonen
	robiatfahlevie
	esen_tan
	nqou
	nathparis