Comment

Comment by awirth

Now that I live in Japan, I've come to learn that for Japanese Windows users, seeing the ¥ symbol as a path separator is normal, it isn't a quirk or a bug. In fact, IIRC the copy machine in the closest convenience store shows a ¥ as the path separator when browsing a USB drive, even though I'm almost certain it's not running Windows.

A few years back, I wrote a CTF challenge around this quirk of SHIFT_JIS. It used a python MySQLdb connection set to SHIFT_JIS mode and a custom naïve mysql escape function. The trick was to use a yen symbol and have it get interpreted as an unescaped backslash, leading to a SQL injection. Also it was all over websockets just to be annoying.

There's a few nice writeups from it:

https://www.kernelpicnic.net/2016/03/06/BKPCTF-Wonderland-Go...

https://0day.work/boston-key-party-ctf-2016-writeups/

https://security.szurek.pl/en/boston-key-party-ctf-2016-good... (this one has the original challenge source)

parent awirth 5 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton