Top 10 winner

WorstFit: Unveiling Hidden Transformers in Windows ANSI!

Orange Tsai · Orange Tsai · 9 January 2025

Windows converts UTF-16 to the ANSI code page with Best-Fit mappings: fullwidth quote U+FF02 becomes ", yen U+00A5 becomes \, soft hyphen becomes -. GetCommandLineA and the CRT behind plain main() apply this after escapeshellarg or list2cmdline have escaped, so the escaping is undone and extra arguments split out (tar --use-compress-program, wget --use-askpass). The same conversion smuggles path separators into filenames and CGI PATH_INFO, giving traversal, WAF bypass and LFI.

Record

Researcher

Orange Tsai

Published by

Orange Tsai

Date

9 January 2025

Topic

Other

In the archive

• Ranked #4 in the 2024 Top 10 Web Hacking Techniques

Related sources

• WorstFit presentation slides Whitepaper
• Unraveling Unicode: A Bag of Tricks for Bug Hunting Whitepaper
• Earlier encoding research (2008) Whitepaper
• PHP-CGI vulnerability advisory Advisory
• WorstFit: Unveiling Hidden Transformers in Windows ANSI!

Tags

• charset
• unicode
• filter-bypass
• command-injection
• rce
• path-traversal
• waf-bypass
• lfi
• owasp-a01-2021
• owasp-a02-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Orange Tsai, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.