Hacking with Unicode in 2016
summary
Unicode has ~1.1M code points (up to 0x10FFFF) split into a 65k BMP and astral planes, and this causes concrete bugs: JavaScript counts astral symbols as two (length reports 2 for U+1F4A9), ES6 fixes via Array.from / spread and normalize; MySQL’s default utf8 truncates 4‑byte chars so switching to utf8mb4 prevents silent data loss that enables account-takeover and WordPress/Joomla RCE via serialized payload truncation; encoding mismatches (UTF‑16/32 → UTF‑8) enable XSS; tools demonstrated: jss, punycode, srever.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:01Unicode basics
- 3:56Choosing an encoding
- 5:25Unicode in JavaScript
- 12:12Advanced string handling
- 18:51Unicode in MySQL
- 20:53Exploiting encoding issues
- 27:26JSON and Unicode risks
- 32:01Real-world vulnerability case
- 44:56Conclusion
