Collected research

Unraveling Unicode: A Bag of Tricks for Bug Hunting

Chris Weber · blackhat.com

A Black Hat USA 2009 deck cataloguing how Unicode handling breaks security boundaries: best-fit mapping, NFKC/NFKD normalisation, overlong UTF-8, over-consumption of ill-formed MBCS bytes, character deletion and casing. Each root cause is shown turning filtered input into live markup, with case studies against a social network, Safari/Firefox BOM handling and Opera.

Record

Researcher

Chris Weber

Published by

blackhat.com

Format

Whitepaper

Topic

Other

In the archive

• Collected in the 2009 research round

Tags

• unicode
• encoding
• charset
• filter-bypass
• xss
• url-parsing
• tooling
• survey
• owasp-a02-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Chris Weber, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.