Collected research

Lost in Translation - WAF Bypasses By Abusing Data Manipulation Processes

Ryan Barnett · Blogger

Abusing Unicode normalization to defeat input validation and WAF signatures, presented as an impedance mismatch between layers - browser, CDN or WAF, framework, database - that decode, normalize or truncate text differently. Four abuse classes are enumerated: percent-decoders that are not multi-byte aware, overlong UTF-8 sequences, visual confusables, and truncation of codepoints to ASCII. The argument is that the order of normalization, not normalization itself, decides the outcome.

Record

Researcher

Ryan Barnett

Published by

Blogger

Format

Slides

Topic

Other

In the archive

• Collected in the 2024 research round

Related sources

• Lost in Translation: Exploiting Unicode Normalization

Tags

• unicode
• encoding
• waf-bypass
• filter-bypass
• parser-differential
• charset
• url-parsing
• ssti
• owasp-a02-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Ryan Barnett, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.