GitBook: [#3446] unicode injection

SUMMARY.md

@@ -522,7 +522,8 @@
   * [EL - Expression Language](pentesting-web/ssti-server-side-template-injection/el-expression-language.md)
   * [Jinja2 SSTI](pentesting-web/ssti-server-side-template-injection/jinja2-ssti.md)
 * [Reverse Tab Nabbing](pentesting-web/reverse-tab-nabbing.md)
-* [Unicode Normalization vulnerability](pentesting-web/unicode-normalization-vulnerability.md)
+* [Unicode Injection](pentesting-web/unicode-injection/README.md)
+  * [Unicode Normalization](pentesting-web/unicode-injection/unicode-normalization.md)
 * [Web Tool - WFuzz](pentesting-web/web-tool-wfuzz.md)
 * [XPATH injection](pentesting-web/xpath-injection.md)
 * [XSLT Server Side Injection (Extensible Stylesheet Languaje Transformations)](pentesting-web/xslt-server-side-injection-extensible-stylesheet-languaje-transformations.md)

pentesting-web/unicode-injection/README.md

@@ -0,0 +1,80 @@
+# Unicode Injection
+
+<details>
+
+<summary><strong>Support HackTricks and get benefits!</strong></summary>
+
+Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
+
+Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
+
+Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+
+**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
+
+**Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
+
+</details>
+
+## Introduction
+
+Depending on how the back-end/front-end is behaving when it **receives weird unicode characters** an attacker might be able to **bypass protections and inject arbitrary characters** that could be used to **abused injection vulnerabilities** such as XSS or SQLi.
+
+## Unicode Normalization
+
+Unicode normalization occurs when **unicode characters are normalized to ascii characters**.
+
+One common scenario of this type of vulnerability occurs when the system is **modifying** somehow the **input** of the user **after having checked it**. For example, in some languages a simple call to make the **input uppercase or lowercase** could normalize the given input and the **unicode will be transformed into ASCII** generating new characters.\
+For more info check:
+
+{% content-ref url="unicode-normalization.md" %}
+[unicode-normalization.md](unicode-normalization.md)
+{% endcontent-ref %}
+
+## `\u` to `%`
+
+Unicode characters are usually represented with the **`\u` prefix**. For example the char `㱋` is `\u3c4b`([check it here](https://unicode-explorer.com/c/3c4B)). If a backend **transforms** the prefix **`\u` in `%`**, the resulting string will be `%3c4b`, which URL decoded is: **`<4b`**. And, as you can see, a **`<` char is injected**.\
+You could use this technique to **inject any kind of char** if the backend is vulnerable.\
+Check [https://unicode-explorer.com/](https://unicode-explorer.com/) to find the chars you need.
+
+This vuln actually comes from a vulnerability a researcher found, for a more in depth explanation check [https://www.youtube.com/watch?v=aUsAHb0E7Cg](https://www.youtube.com/watch?v=aUsAHb0E7Cg)
+
+## Emoji Injection
+
+Back-ends something behaves weirdly when they **receives emojis**. That's what happened in [**this writeup**](https://medium.com/@fpatrik/how-i-found-an-xss-vulnerability-via-using-emojis-7ad72de49209) where the researcher managed to achieve a XSS with a payload such as: `💋img src=x onerror=alert(document.domain)//💛`
+
+In this case, the error was that the server after removing the malicious characters **converted the UTF-8 string from Windows-1252 to UTF-8** (basically the input encoding and the convert from encoding mismatched). Then this does not give a proper < just a weird unicode one: `‹`\
+``So they took this output and **converted again now from UTF-8 ot ASCII**. This **normalized** the `‹` to `<` this is how the exploit could work on that system.\
+This is what happened:
+
+```php
+<?php
+
+$str = isset($_GET["str"]) ? htmlspecialchars($_GET["str"]) : "";
+
+$str = iconv("Windows-1252", "UTF-8", $str);
+$str = iconv("UTF-8", "ASCII//TRANSLIT", $str);
+
+echo "String: " . $str;
+```
+
+Emoji lists:
+
+* [https://github.com/iorch/jakaton\_feminicidios/blob/master/data/emojis.csv](https://github.com/iorch/jakaton\_feminicidios/blob/master/data/emojis.csv)
+* [https://unicode.org/emoji/charts-14.0/full-emoji-list.html](https://unicode.org/emoji/charts-14.0/full-emoji-list.html)
+
+<details>
+
+<summary><strong>Support HackTricks and get benefits!</strong></summary>
+
+Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
+
+Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
+
+Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+
+**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
+
+**Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
+
+</details>

pentesting-web/unicode-injection/unicode-normalization.md

@@ -1,6 +1,4 @@
-# Unicode Normalization vulnerability
-
-## Unicode Normalization vulnerability
+# Unicode Normalization
 
 <details>
 
@@ -38,7 +36,7 @@ Before we delve into Unicode attacks, the following are the main points to under
 
 An example of how Unicode normalise two different bytes representing the same character:
 
-![](<../.gitbook/assets/image (156).png>)
+![](<../../.gitbook/assets/image (156).png>)
 
 **A list of Unicode equivalent characters can be found here:** [https://appcheck-ng.com/wp-content/uploads/unicode\_normalization.html](https://appcheck-ng.com/wp-content/uploads/unicode\_normalization.html)
 
@@ -56,7 +54,7 @@ Imagine a web page that is using the character `'` to create SQL queries with th
 
 Then, a malicious user could insert a different Unicode character equivalent to `' (0x27)` like `%ef%bc%87` , when the input gets normalised, a single quote is created and a **SQLInjection vulnerability** appears:
 
-![](<../.gitbook/assets/image (157) (1).png>)
+![](<../../.gitbook/assets/image (157) (1).png>)
 
 **Some interesting Unicode characters**
 
@@ -90,11 +88,11 @@ Then, a malicious user could insert a different Unicode character equivalent to
 
 You could use one of the following characters to trick the webapp and exploit a XSS:
 
-![](<../.gitbook/assets/image (312).png>)
+![](<../../.gitbook/assets/image (312).png>)
 
 Notice that for example the first Unicode character purposed can be sent as: `%e2%89%ae` or as `%u226e`
 
-![](<../.gitbook/assets/image (215) (1) (1).png>)
+![](<../../.gitbook/assets/image (215) (1) (1).png>)
 
 ## References
 

pentesting-web/web-vulnerabilities-methodology.md

@@ -139,7 +139,7 @@ This vulnerabilities might help to exploit other vulnerabilities.
 * [ ] [**Domain/Subdomain takeover**](domain-subdomain-takeover.md)
 * [ ] [**IDOR**](idor.md)
 * [ ] [**Parameter Pollution**](parameter-pollution.md)
-* [ ] [**Unicode Normalization vulnerability**](unicode-normalization-vulnerability.md)
+* [ ] [**Unicode Normalization vulnerability**](unicode-injection/)
 
 <details>
 

pentesting-web/xss-cross-site-scripting/README.md

@@ -705,7 +705,7 @@ Also, don't forget that **at the end of the mentioned post** you can find an exp
 
 ### Normalised Unicode
 
-You could check is the **reflected values** are being **unicode normalized** in the server (or in the client side) and abuse this functionality to bypass protections. [**Find an example here**](../unicode-normalization-vulnerability.md#xss-cross-site-scripting).
+You could check is the **reflected values** are being **unicode normalized** in the server (or in the client side) and abuse this functionality to bypass protections. [**Find an example here**](../unicode-injection/#xss-cross-site-scripting).
 
 ### PHP FILTER\_VALIDATE\_EMAIL flag Bypass