Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Unicode Normalization Bug

Rohit | Last updated: Sep 13, 2020 12:46PM UTC

During one of the pentests I was attempting to test for the Hostsplit unicode normalization vulnerability by tampering with the host header. More details about this vulnerability can be found here https://i.blackhat.com/USA-19/Thursday/us-19-Birch-HostSplit-Exploitable-Antipatterns-In-Unicode-Normalization-wp.pdf The test can be performed by adding a Host header as Host: www.evil.c℀.victim.com However, When I try to do this , burpsuite modifies this request and makes the Host header as Host: www.evil.c.victim.com which in my opinion should not be happening. As I need to check how the server is processing it. For a successful attack (i.e. the server is vulnerable) the server should be processing it as , which makes it a very critical vulnerability Host: www.evil.ca/c.victim.com This seems to be a bug in Burpsuite as it should not be normalising the request and rather send it as is.

ayub | Last updated: Sep 13, 2020 01:19PM UTC

Yes,Burp converting ℀ to null char. And also i have observed that, if you copy paste russian alphabet like ё into burp and perform any action, it will convert it into some other character ex: ё --> Q i think burp does not support other than English alphabets.

Michelle, PortSwigger Agent | Last updated: Sep 14, 2020 02:04PM UTC