3 ms·
It's not clear what domain he actually registered. xn--jxb.fi would appear to be unregistered. (U+2167) (U+002E) (U+FB01) is not a valid domain name. viii.fi
by AndyMcConachie 6y ago
It's not clear what domain he actually registered.
xn--jxb.fi would appear to be unregistered.
(U+2167) (U+002E) (U+FB01) is not a valid domain name.
viii.fi (all ASCII) is registered, and the registrar is gandi. But so what?
I don't get it.
- edent 6y agoHi Andy. I'm OP. As you spotted, I registered v i i i. fi with Gandi. When your browser see the Ⅷ character, it performs the IDNA2008 process listed in RFC5895 to normalise it. The same thing happens in OS tools like dig and ping. Hope that makes a bit more sense.
- dom96 6y agoYeah, I read the article and just now went back and read the Minimal Viable XSS article linked as well. I am also rather puzzled. This seems to be only useful if you manage to find a website with an XSS flaw and one that also limits the input to 20 characters? Are these situations really common enough to warrant this attack? It all seems rather arbitrary to me.
- edent 6y agoI'm a rather amateur bug hunter but, yes, some sites do use string length limitations as a way of filtering out dodgy code. They shouldn't - but they do. (See https://www.openbugbounty.org/researchers/edent/ https://www.openbugbounty.org/researchers/edent/)