Hammering...

Unicode characters that get normalized into path traversal characters

This vector performs normalization and compares to see if the characters get normalized into path traversal characters

Shazzer Master

Created byhackvertor

Created Dec 12, 2024

Updated Sep 5, 2026

Unable to render tweet button

Detecting browser...

CategoryJavaScript Syntax

VisibilityPublic

TypeJS

CharsetUTF-8

Code used before fuzz:

const charsToCheck = ["\\","/","."];
const normalizationForms = ["NFKC", "NFC", "NFD", "NFKD"];

Template used:

$[i] > 0x7f && normalizationForms.forEach(form => {
    const normalized = String.fromCodePoint($[i]).normalize(form);
    for(let charToCheck of charsToCheck) {
       if(charToCheck === normalized) {
            log(String.fromCodePoint($[i])+"("+form+")"+"="+charToCheck);
        }
     }
})

Sample payloads

0 > 0x7f && normalizationForms.forEach(form => {
    const normalized = String.fromCodePoint(0).normalize(form);
    for(let charToCheck of charsToCheck) {
       if(charToCheck === normalized) {
            alert(String.fromCodePoint(0)+"("+form+")"+"="+charToCheck);
        }
     }
})