unicode-normalization-bypass

What problem does it solve?

Web application firewalls (WAFs) and input filters often block standard attack payloads, but if the backend normalizes Unicode input before processing, these filters can be bypassed, leaving vulnerabilities like XSS, SSTI, and SQLi exposed. This Skill solves that problem by providing proven techniques to test for and exploit these normalization gaps.

Core Features & Use Cases

• Unicode Character Substitution: Replace blocked special characters (like <, >, ', /) with fullwidth, mathematical, or script variant Unicode equivalents that pass WAF checks but normalize to the original character on the backend.
• Surrogate Wildcard Injection: Exploit invalid Unicode surrogate characters that get converted to replacement characters, then simplified to wildcards in Solr/Elasticsearch backends to leak data via broadened search results.
• Multi-Layer Encoding Bypass: Stack URL encoding with Unicode normalization to bypass WAFs that only decode one layer of input before filtering.
• Use Case: A security tester can use this Skill to assess if a web application's input filtering is vulnerable to Unicode bypass, identifying gaps that could be exploited by attackers.

Quick Start

Use the unicode-normalization-bypass skill to test if the target web application's backend normalizes Unicode input by submitting fullwidth character payloads to its text input fields and checking if the processed output matches the expected ASCII equivalent.