The Ordering Problem at the Root of Every Attack

▶ Watch (02:51)

Security checks run before data normalization across CDN-to-application pipelines. The attack model is simple: input passes a WAF or upstream filter in its raw form, then the application normalizes it, producing something the security check never saw. Ryan Barnett sorted years of Akamai telemetry into buckets and traced every case to the same root cause, which he calls CWE-180. The order of operations is what makes the next four attack categories work.

“later on, data changes, recipe for disaster.” — Ryan Barnett

Overlong Encoding: Smuggling Payloads Past UTF-8 Parsers

▶ Watch (05:17)

A single ASCII character like “A” occupies one byte. Overlong encoding forces it into two or three bytes anyway. The format violates the modern UTF-8 spec, but many parsers accept it. Nimda (2001) used this to bypass dot-dot-slash detection: the traversal sequence was overlong-encoded, cleared the WAF, then normalized to real path characters by IIS. SQLmap still ships a tamper script that overlong-encodes the space character. Burp’s default decoder produces mojibake on multi-byte input; active scan++ was updated to detect non-multibyte-aware decoding by checking whether a Greek alpha transforms into two unrelated ASCII characters.

Byte Truncation: Control Characters Hidden in Multi-Byte Wrappers

▶ Watch (13:05)

A four-byte UTF-8 character fed into a one-byte buffer gets truncated to its least significant byte. Isabella Barnett demonstrated this with a Microsoft bug-bounty report: the attacker UTF-8-encoded carriage return and line feed as Chinese characters. Burp’s decoder showed innocuous glyphs, but the little-endian server stored only the last byte of each, which happened to be CR and LF. The result was a Set-Cookie header injected into the response. Shazzer, by Gareth Hayes, accepts a hex value and returns every Unicode codepoint that truncates to it.

Best-Fit Mapping: When Lookalike Characters Become Real Ones

▶ Watch (15:17)

Best-fit mapping converts Unicode characters to the closest ASCII counterpart. Microsoft’s code page 1251 maps the Unicode full stop to an ordinary dot. The DotNetNuke case (Searchlight Cyber) shows the full chain: a file upload used full-width backslashes and dots. The regex checked for ASCII dots, found none, and passed it. Code page 1251 then converted those characters to real ASCII, producing a UNC path that triggered outbound NTLM authentication and leaked credentials. Ryan Barnett confirmed the same class of normalization is detectable live via the active scan++ Kelvin sign normalization detection demo (22:49).

Casing Transforms as an Attack Surface

▶ Watch (23:40)

Python’s str.upper() maps the Latin small letter dotless-i (U+0131) to capital I. That breaks XSS filters checking for the lowercase string “script”. An attacker sends a payload with the dotless-i in place of the normal i. The filter sees a non-ASCII character and passes it. The application’s .upper() call then reassembles a valid script tag the browser executes. Ryan Barnett worked with the creator of recolapse to add casing flags: input a target character, get back every Unicode character that case-folds to it.

Combining Characters: Decomposition and Account Takeover

▶ Watch (27:01)

Combining characters attach to the codepoint before them, changing its identity. Isabella Barnett showed two attacks. MySQL configured with utf8mb4_0900_ai_ci (accent-insensitive, case-insensitive) treats “a” with a double grave accent as identical to plain “a”. An attacker requests a password reset using a Unicode variant of victim@gmail.com.

“yes, this is usergmail.com.” — Isabella Barnett

The database matches it to the real account and sends the token to the attacker’s address. Separately, she demonstrated the combining diacritics XSS demo on XSSE lab (30:14): prepending the combining long solidus overlay to “>” produces the not-greater-than symbol, breaking a textarea tag context and enabling XSS via an onfocus event handler. Active scan++ was updated to detect both patterns.

Notable Quotes

later on, data changes, recipe for disaster. Ryan Barnett · ▶ 3:08

yes, this is usergmail.com. Isabella Barnett · ▶ 26:37

cross-sight scripting performed. Isabella Barnett · ▶ 31:26

Key Takeaways

  • CWE-180 is the root cause: security validation must run after full canonicalization, not before.
  • Overlong encoding, byte truncation, best-fit mapping, casing, and combining characters all exploit the same ordering flaw.
  • Active scan++ and recolapse were updated to detect suspicious input transformations using Kelvin sign, combining overlays, and casing probes.