Collaborate Disseminate
I’m conducting tests using hashcat and find it very difficult if the hash is encoded.
See the below function which takes the plain text, converts that to the bytes, creates the SHA512 hash and then encode to string.
static string GetSHA512… Continue reading Cracking UTF encoded hash using hashcat
For anyone old enough to have worked with the hell of multiple incompatible character sets, Unicode has been a liberation; a true One Character Set To Contain Them All. We …read more Continue reading Can You Identify This Mystery Unicode Glyph?
Owners of physical Trezor cryptocurrency wallets should be on their guard after an email was sent out by thieves attempting to dupe them into downloading new software to their devices. Continue reading Trezor wallets hacked? Don’t be duped by phishing attack email
In a database table, I was running some phone number validations and I noticed that some unicode characters were inserted in a phone number field.
The characters are:
(U+202C): Pop Directional Formatting
(U+202D): Left-to-Right Override
I am practicing some malware detection basics and it has caught my attention that the Cyrillic alphabet is not detected by practically any traditional string detection tool.
Source Code
while (strcmp(password, user_input) != 0)
{
p… Continue reading Floss and many tools not detecting cyrillic strings in binary
A new critical issue was discovered in the character definitions of the Unicode Specification through 14.0.
Does it only affect code compiled from sources with disallowed unicode characters?
RHEL describes that it is relevant only to GCC.
… Continue reading Does CVE-2021-42694 affect only compiled code?
Lately, the security community has been asking interesting questions around surprising side effects of raw Unicode formatting characters in source code. That got me thinking about input validation and display in web apps. Normally, I rely … Continue reading What are best practices for handling user Unicode in a web application?
The job of a dumb terminal was originally to be a continuation of that performed by a paper teletype, to send text from its keyboard and display any it receives …read more Continue reading This Arduino Terminal Does All The Characters
I am pentesting a web application. It makes a backend call to another application, and I am trying to hijack that call.
I have gained control over the URL path, query parameters, and fragment that is being sent (e.g. if the URL is https://… Continue reading Is there any way to get a unicode character that has a byte of 23?
Most readers will have at least some passing familiarity with the terms ‘Unicode’ and ‘UTF-8’, but what is really behind them? At their core they refer to character encoding schemes, …read more Continue reading Unicode: On Building The One Character Set To Rule Them All