Unicode characters with a decomposition of 2+ ASCII characters and are registerable domains

175

175

175

This vector shows Unicode characters that have a decomposition of 2 or more ASCII characters, which get normalized by the browser. These characters are valid for use as domain names, expanding short strings into longer ones through decomposition.

Created on: Wednesday, May 7, 2025 at 10:33:32 PM

Updated on: Friday, May 23, 2025 at 5:34:53 PM

Vector type: XSS

Vector charset: UTF-8

<a id="x" href="https://$[chr].com">

function is_domain(domain) {
  return domain.split('.').every(part => /^[a-z0-9-]+$/i.test(part));
}
let host = x.host.replace('.com', '')
if(host.length > 1 && host.length < 5 && is_domain(host)){
log($[i] + "=>" + host)
}