farhan nadim pial pial-vai

## 1_top+hacker_methodologies.md

      
              6 files
            
          
              0 forks
            
          
              0 comments
            
          
              1 star
            
          
                pial-vai
                / 1_top+hacker_methodologies.md
            
            
              Created
              January 7, 2024 18:37
                — forked from ruevaughn/1_top+hacker_methodologies.md
            
              
                 Hacker Methodologies & Tools (NEW)
              
          
    The Top Hacker Methodologies & Tools Notes

By Chase.  ** *

Nuclei Templates
Concrete5 CMS : Identification, Mass Hunting, Nuclei Template Writing & Reporting


My Methodology


## index.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                pial-vai
                / index.md
            
            
              Created
              December 10, 2023 06:44
                — forked from paj28/index.md
            
          
    Unicode XSS via Combining Characters

Most application security practitioners are familiar with Unicode XSS, which typically arises from the Unicode character fullwidth-less-than-sign. It’s not a common vulnerability but does occasionally appear in applications that otherwise have good XSS protection. In this blog I describe another variant of Unicode XSS that I have identified, using combining characters. I’ve not observed this in the wild, so it’s primarily of theoretical concern. But the scenario is not entirely implausible and I’ve not otherwise seen this technique discussed, so I hope this is useful.
Recap of Unicode XSS

Lab: https://4t64ubva.xssy.uk/
A quick investigation of the lab shows that it is echoing the name parameter, and performing HTML escaping: