(no title)
awirth | 4 years ago
A few years back, I wrote a CTF challenge around this quirk of SHIFT_JIS. It used a python MySQLdb connection set to SHIFT_JIS mode and a custom naïve mysql escape function. The trick was to use a yen symbol and have it get interpreted as an unescaped backslash, leading to a SQL injection. Also it was all over websockets just to be annoying.
There's a few nice writeups from it:
https://www.kernelpicnic.net/2016/03/06/BKPCTF-Wonderland-Go...
https://0day.work/boston-key-party-ctf-2016-writeups/
https://security.szurek.pl/en/boston-key-party-ctf-2016-good... (this one has the original challenge source)
emodendroket|4 years ago
thisisnico|4 years ago
Tagbert|4 years ago
ensiferum|4 years ago
tom_|4 years ago
signal11|4 years ago
Also for people working in many Japanese MNCs.