HostSplit: Exploitable Antipatterns in Unicode Normalization
This talk demonstrates new exploit techniques that leverage Unicode normalization behavior to bypass URL security filters and, in some cases, allow one domain to impersonate another. Where previous attacks against internationalized domain names relied on visual spoofing, these attacks fool software with URL strings that are parsed as belonging to one hostname but resolved as belonging to a different host name.
By Jonathan Birch
Full Abstract & Presentation Materials: https://www.blackhat.com/us-19/briefi...
