Collected research

JSON Hijacking with UTF-7

Yosuke Hasegawa · powerofcommunity.net

POC2008 deck surveying attacks that live in character encoding: overlong UTF-8, many-to-one Unicode conversion and post-validation normalisation reopening path traversal, invalid and lead bytes bypassing filters including IE8's XSS filter, and UTF-7 XSS wherever charset is absent or unrecognised.

Record

Researcher

Yosuke Hasegawa

Published by

powerofcommunity.net

Format

Slides

Topic

Other

In the archive

• Collected in the 2008 research round

Tags

• charset
• unicode
• encoding
• xss
• filter-bypass
• parser-differential
• path-traversal
• url-spoofing
• owasp-a01-2021
• owasp-a02-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Yosuke Hasegawa, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.