HostSplit: Exploitable Antipatterns in Unicode Normalization

on YouTube ↗40m

" summary

A new class of Unicode normalization exploits lets a URL parse as one hostname but resolve as another, enabling URL-filter bypass and domain impersonation. The key trick uses IDNA normalization + Punycode where characters normalize into syntax (e.g. full‑width slash → /), enabling HostSplit redirects that once let Edge/IE forward Office 365 OAuth tokens via a covert redirect chain (live.com → Dropbox example). Tests use DNS monitoring or wildcard domains; vulnerable platforms included .NET, Python, Java, Windows APIs and libidn (many later patched). HostBond is a related invisible‑character variant.

AI-written summary · about

" chapters (7)

1. 0:00Introduction
2. 0:34Agenda
3. 8:08HostSplit
4. 15:58Whats vulnerable
5. 26:12Whats not vulnerable
6. 32:17How to test
7. 36:37Best practices

" related talks

• 54mUnicodes Gone WildChristien Rioux, DilDog · AppSec California 2015
• 59mBrowsers Gone WildXiaoran Wang, Angelo Prado · Black Hat Asia 2015
• 31mNew Techniques for Split-Second DNS RebindingDaniel Thatcher · Black Hat Europe 2023
• 42mModern web application bugsErlend Oftedal · NDC Sydney 2018
• 56mUnicode - going down the rabbit holePeter Bindels · NDC TechTown 2019
• 47mA New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!Orange Tsai · Black Hat Asia 2018
• 40mUnicode: The hero or villain?Paweł Krawczyk · OWASP AppSec Europe 2018
• 29mChar Wars: The Path Traversal Strikes BackLiran Tal · NodeTLV 2023