4 ms·
txet lanoitcerid-iB
- deleted 12y ago[deleted]
- jakub_g 12y agoYou can exploit this trick to some extent to name a file in a way that spoofs its real extension. E.g. name an .exe file such that it looks like if it was .doc (and give the exe an icon associated often with .doc to be even more convincing).
- 13 12y agoWorks on URLs too. http://myspace.com/#/segami/moc.koobecaf//:sptth http://myspace.com/#/segami/moc.koobecaf//:sptth
- joelthelion 12y agoPretty dangerous, but at least my browser corrects it in the address bar.
- cnrsvxz 12y agoThis has been done by FinFisher: https://www.youtube.com/watch?v=sW-N7qQU-tA#t=14m04s https://www.youtube.com/watch?v=sW-N7qQU-tA#t=14m04s
- rwmj 12y agoNice - confuses XFCE as well: http://oirase.annexia.org/tmp/hackernews.png http://oirase.annexia.org/tmp/hackernews.png
- jaachan 12y agoChrome tab has the title inverted as well
- hayksaakian 12y agoThe URL is on the left of the submission title. Is this somehow related?
- 13 12y agoThe submission title is actually "txet lanoitcerid-iB", with a Right To Left Override control character at the front. The whole line is in reverse it just doesn't look like it when rendered in your browser. There's a variety of control characters in unicode which let you stack, reverse, raise and lower individual pieces of text as you desire. .ekil skool yllaer ti tahw ees ll'uoy dna enil siht gnitsap dna ypoc yrT
- hayksaakian 12y agoInteresting, I viewedmthe source of the page, and some of the tags are reversed too. Is this an exploit/attack vector?
- cbd1984 12y agoAnything that can confuse a person is a potential exploit vector. That said, I don't know of any specific exploits which rely on this behavior.
- kowdermeister 12y agoYes, right click -> inspect element on the link.
- glifchits 12y agoTake a closer look at the URL while you're at it. It may look like an obscure domain, but its really not.
- AReallyGoodName 12y agoCheck your browsers title bar right now.
- im3w1l 12y agoYou can do the same with sourcecode too. System.out.println("Do live"); // not doog Right-left-override is fun, but to see it really shine you have to combine it with some pop-directional-formatting.
- deleted 12y ago[deleted]