See also ascii smuggling, zalgo
Smuggling arbitrary data through an emoji
201–206 of 206 posts
Re: Smuggling arbitrary data through an emoji
#202Oh this is just the tip of the iceberg when it comes to abusing Unicode! You can use a similar technique to this to overflow the buffer on loads of systems that accept Unicode strings. Normally it just produces an error and/or a crash but sometimes you get lucky and it'll do all sorts of fun things! :) I remember doing penetration testing waaaaaay back in the day (before Python 3 existed) and using mere diacritics to…
This was the premise of a Google CTF quals 2024 challenge ("encrypted runner").
Re: Smuggling arbitrary data through an emoji
#20310 years or so ago I shocked coworkers with using U+202D LEFT-TO-RIGHT OVERRIDE mid in filenames on windows. So funnypicturegnp.exe became funnypictureexe.png Combined with a custom icon for the program that mimics a picture preview it was pretty convincing.
I created a guitar_tab.txt which was a bat file.
Re: Smuggling arbitrary data through an emoji
#204That's neat! Now I'm wondering if this could be used to smuggle Signal links through Xitter....
Re: Smuggling arbitrary data through an emoji
#205StegCloak [0] is in the same ballpark and takes this idea a step further by encrypting the hidden payload via AES-256-CTR -- pretty neat little trick [0] https://github.com/KuroLabs/stegcloak
There's a Better Discord plugin that I think uses this or something similar, so you could send completely encrypted messages, that look like nothing to everyone else. You'd need to share a password secret for them to decode it though.
Could probably add OTR, too.
Re: Smuggling arbitrary data through an emoji
#206Isn't it also an option to use this to generate pretty decent passwords? Like including one of those unicode chars encoded with a message, pretty sure no password cracking tool currently has support for this