Bypassing WAFs with Unicode Compatibility#

Web Application Firewalls (WAFs) often rely on blacklists. They block <script>, javascript:, and alert(. But what if we can write these words without using standard ASCII characters?

The Magic of Unicode Normalization#

Many systems normalize input before processing it. This means they convert "fancy" characters into their standard ASCII equivalents.

• ＜ (Fullwidth Less-Than) becomes <
• ｓｃｒｉｐｔ (Fullwidth Latin) becomes script
• ℡ (Telephone Sign) might become TEL

The Attack#

If the WAF checks the input before normalization, but the backend application processes it after normalization, we have a bypass.

Example: XSS#

WAF Rule: Block <script>

Payload: ＜ｓｃｒｉｐｔ＞alert(1)＜/ｓｃｒｉｐｔ＞

Flow:

1. WAF: Sees ＜ｓｃｒｉｐｔ＞. This does not match <script>. PASS.
2. Backend: Normalizes input. ＜ｓｃｒｉｐｔ＞ becomes <script>.
3. Execution: The browser executes the script.

Finding Compatible Characters#

You can use the IDNA (Internationalizing Domain Names in Applications) standard to find these mappings.

• I can be represented by Ⅰ (Roman Numeral One)
• K can be represented by K (Kelvin Sign)

Conclusion#

Unicode is vast and complex. Whenever you face a WAF, check if the application performs normalization. It might be your golden ticket.

Normalization Forms#

Unicode defines several normalization forms: NFD splits characters into base plus mark, NFKD further applies compatibility decomposition, NFC recomposes. Compatibility characters are why ＜ maps to <: it is a presentation form of the ASCII less-than.

Copy code
import unicodedata
print(unicodedata.normalize('NFKD', '＜ｓｃｒｉｐｔ＞'))
# <script>

NFKD is the dangerous one for filters. It folds fullwidth, ligatures, and some circled letters into ASCII.

Real-World Variations#

• Fullwidth Latin: ＡＢＣ -> ABC
• Roman numerals: Ⅰ Ⅱ Ⅲ -> I II III
• Kelvin sign: K -> K
• Ligatures: fi -> fi
• Parenthesized letters: ⒜ -> a

Bypass Conditions#

The bypass needs an ordering gap:

1. WAF decodes and pattern-matches.
2. Backend normalizes later (framework, database collation, or browser).
3. Browser or DB executes the normalized result.

If the WAF normalizes too, the trick collapses. Test by sending the fullwidth form and checking whether the backend error message echoes the normalized ASCII.

Detection on the Defensive Side#

Normalize at the edge. Convert every input to NFKC at the reverse proxy, then evaluate rules. Log the raw and normalized forms side by side; a mismatch between them flags a probe.

Copy code
# Conceptual: do not ship as-is; normalization belongs in code, not nginx.
# Log raw vs normalized at the app entry instead.

Also deny or flag control-character runs and mixed-script identifiers (a homoglyph а from Cyrillic next to Latin a). Mixed scripts in a single token is a strong probe signal.

Lab Exercise#

Copy code
# 1. Start a vulnerable target
docker run -p 8080:80 vulnerable/app:latest

# 2. Send the fullwidth payload through a proxy
curl 'http://localhost:8080/search?q=%EF%BC%9Cscript%EF%BC%9E'

# 3. Compare response with the ASCII equivalent
curl 'http://localhost:8080/search?q=<script>'

If the fullwidth request returns a processed page and the ASCII one returns a WAF block, you have confirmed the gap.

Homoglyph Hunt Spots#

• Scope or origin checks that compare example.com but accept еxample.com (Cyrillic e).
• Path allowlists where the normalize step runs after the match.
• Header values that pass IDNA-unaware filters.

IDNA and Unicode#

Domain names go through a Punycode conversion (IDNA2008). Some lookalikes stay visually plausible in the browser: раураl.com (Cyrillic) points somewhere else entirely. Browsers now flag high-risk mixes with a warning, but internal dashboards may not.

Filter Gap Analysis#

Copy code
raw = "<script>"
fullwidth = "＜ｓｃｒｉｐｔ＞"

def naive_filter(s):
    return "<script>" not in s

print(naive_filter(raw))        # False -> blocked
print(naive_filter(fullwidth))  # True  -> passes filter

The gap exists when normalize runs after the filter. Test in a lab, not on a live service.

Encoding Stack#

Each step is a place where a filter can sit. Map the pipeline order on your target; the bypass lives in the gap.

Charset Confusion#

UTF-7 and legacy charsets produce similar gaps. Input declared as UTF-8 but parsed as UTF-7 can let +ADw-script+AD4- pass a UTF-8 regex and render as <script> in an old IE context. Modern browsers mitigate, but kiosk and legacy apps still ship the bug.

Practical Reporting#

Include the raw request (hex of the fullwidth bytes), the normalized response body, and the exact pipeline order that your testing observed. A WAF vendor reads that and can fix the ordering, not just the rule.

Mixed-Script Detection#

A token that mixes Latin and Cyrillic characters is rare in legitimate input. Flag them:

Copy code
def mixed(s):
    scripts = set()
    for ch in s:
        if 'a' <= ch.lower() <= 'z':
            scripts.add('latin')
        if 'а' <= ch.lower() <= 'я':
            scripts.add('cyrillic')
    return len(scripts) > 1

A probe that uses mixed scripts is either a test or an attack; either way it deserves a log line.

ZAP and Normalization#

When ZAP reports a fullwidth payload as a hit, verify whether the response actually normalized it. Scanner output reports the match on the request side; the backend behavior decides whether it is real.

IDNA Display#

Some old browsers show a Unicode domain's ASCII lookalike, not its real characters. Operators reviewing certificates can miss this. Use whois and Punycode form (xn--...) to confirm what the cert names.

Normalization in Frameworks#

• Node: String.prototype.normalize('NFKD').
• Python: unicodedata.normalize.
• Java: Normalizer.normalize.
• Go: golang.org/x/text/unicode/norm.

Whichever form your stack uses decides which bypasses exist. Test the library's default on a scratch string before calling any filter sufficient.

Charset Test List#

Send the same payload in UTF-8, UTF-16LE, UTF-16BE, and GBK where the target accepts those encodings. Different decoders normalize differently, and the WAF usually tests only one.

Lab Matrix#

For each candidate, run:

• Fullwidth payload through the WAF and the direct backend
• NFKD normalization before vs after the filter
• Mixed-script token detection on the watchlist
• UTF-7 or alternate codec fallback test
• IDNA normalization on any URL parameter
• Charset comparison across UTF-8 and UTF-16

Reference Tables#

Reminders#

2. confirm before reporting
3. confirm before reporting
4. confirm before reporting
5. confirm before reporting
6. confirm before reporting
7. confirm before reporting
8. confirm before reporting
9. confirm before reporting
10. confirm before reporting
11. confirm before reporting
12. confirm before reporting
13. confirm before reporting
14. confirm before reporting
15. confirm before reporting

Command Cheatsheet#

Copy code
curl 'https://target/?q=%EF%BC%9Cscript%EF%BC%9E'
curl 'https://target/?q=<script>'
python3 -c "print('＜ｓｃｒｉｐｔ＞')"

Final Notes#

2. confirm, document, report
3. confirm, document, report
4. confirm, document, report
5. confirm, document, report
6. confirm, document, report
7. confirm, document, report
8. confirm, document, report
9. confirm, document, report
10. confirm, document, report
11. confirm, document, report
12. confirm, document, report
13. confirm, document, report
14. confirm, document, report
15. confirm, document, report
16. confirm, document, report
17. confirm, document, report
18. confirm, document, report
19. confirm, document, report
20. confirm, document, report
21. confirm, document, report

Short Notes#

2. document the observation, then the conclusion
3. document the observation, then the conclusion
4. document the observation, then the conclusion
5. document the observation, then the conclusion
6. document the observation, then the conclusion
7. document the observation, then the conclusion
8. document the observation, then the conclusion
9. document the observation, then the conclusion
10. document the observation, then the conclusion
11. document the observation, then the conclusion
12. document the observation, then the conclusion
13. document the observation, then the conclusion
14. document the observation, then the conclusion
15. document the observation, then the conclusion
16. document the observation, then the conclusion
17. document the observation, then the conclusion
18. document the observation, then the conclusion
19. document the observation, then the conclusion
20. document the observation, then the conclusion
21. document the observation, then the conclusion
22. document the observation, then the conclusion
23. document the observation, then the conclusion

Decoder Ordering Map#

Closing Notes#

1. Verify each observation with a second independent check.
2. Prefer packet, request/response, or log evidence over prose.
3. Tie the finding to the control that should have caught it.
4. Redact secrets but keep the request shape visible.
5. Never quote a payload you have not actually tested.
6. Keep one repro per file; name it clearly.
7. Update the matrix when a new tool or a new gadget appears.
8. Shorten CI runs; the tool should fit in a normal deploy.
9. Confirm a false positive before you report it.
10. A finding without evidence is folklore.
11. Document the exact time delta or row count.
12. Record the binary version or framework version in the report.
13. Every tool output in the report ties to a command.
14. The evidence tree should let a second reader replay the finding.
15. Log the encoding and the raw bytes with the finding.
16. If a fix closes one probe, re-run the others to be sure.
17. Closing one instance rarely closes the class.
18. Rotate pretexts and rate limits so the test keeps signal.
19. Track report rate, not click rate, for awareness campaigns.
20. Keep capture files short; slice the interesting window.
21. ZAP baselines belong in CI, full scans on staging.
22. Burst the auth endpoint, then verify no lockout.
23. Diff lockfiles before running a supply-chain claim.
24. Parameter pollution hides in headers and cookies too.
25. Checksum your dependencies and rotate keys on a schedule.
26. Time-based blind is slow; always pair it with a boolean check.
27. Show the GRANTS output; it proves reachability limits.
28. DOM sinks are data-flow endpoints, not just payload targets.
29. Trusted Types and CSP sit on the same defense line.
30. Stash the tshark JSON slice with the pcap for reference.
31. A short pcap with notes beats a ten-minute capture.
32. Name files with date, host, and window.
33. A flat periodic line in the IO graph is a beacon candidate.
34. Spike bursts in Burp are usually manual, not scanner.
35. Tune Nuclei rate limits so the range is not blocked.
36. sqlmap risk/level flags widen the payload classes.
37. Arjun finds parameters that do not appear in the URL.
38. Keep WordPress plugin nonces in a separate test case.
39. XML-RPC is the slow, quiet way in. Disable it if unused.
40. Backup files in the docroot are findings by themselves.
41. Upload extension checks should run on the normalized name.
42. Homoglyphs hide inside scope lists and allowlists.
43. Normalize at the edge, log raw, never filter before decode.
44. UTF-7 and legacy codecs keep bypassing naive filters.
45. A fullwidth probe that passes is a bug in the pipeline.
46. Rotate keys, pin versions, and rotate them again after a patch.
47. Prototype pollution turns one key into a global change.
48. __proto__ is the first key to block; check constructor too.
49. Run npm ls deep; the vulnerable path is rarely the top level.
50. Refuse constructor.prototype keys at every merge point.
51. Freeze Object.prototype for the server if you must merge.