Put � in random text fields so that developers are...

All posts XSS~1.BUN's posts Post Back to profile

XSS~1.BUN :blobhaj_hearttrans:

Put � in random text fields so that developers are always wondering if they screwed up parsing somewhere.

Like 30 January at 4:39 | Open on cloudisland.nz

43 comments

Erica Briony.

@xssfox for a brief moment I thought I should have it as part of my legal name

30 January at 4:42 | Open on eightpoint.app

12 Lilith it/its𒀭𒈹𒍠𒊩

@steadilyebbing @xssfox we're gonna change our legal name to Lilith Erica Freya 𒂗𒃶𒌌𒀭𒈾 <unknown last name>

30 January at 4:57 | Open on eightpoint.app

ScarletAshes

@12 @steadilyebbing @xssfox interesting name choice...

30 January at 15:58 | Open on eightpoint.app

Deborah Pickett

@xssfox TouchÃ©!

30 January at 4:45 | Open on old.mermaid.town

Colin

@xssfox STICK TO CROSS SITE SCRIPTING YOU MONSTER

30 January at 4:51 | Open on eigenmagic.net

DELETED

@xssfox thoughts on instead creating chaos with ?

30 January at 5:06 | Open on infosec.exchange

Alastair McBain :unverified:

@secoops @xssfox How do those get into posts?

I imagine it's a copy-and-paste thing but no idea.

I don't know why they don't get filtered out when the user hits post.

30 January at 5:52 | Open on woof.tech

DELETED

@asmcbain @xssfox

I'm guessing given it's just a unicode character, it's considered a valid character and no different to the other fun ones like: ☠ ✖ ☢ ☣

30 January at 9:02 | Open on infosec.exchange

Blake Leonard

@secoops @xssfox why not both?

30 January at 6:27 | Open on infosec.town

.:/ DiSCATTe \:.

@xssfox don't forget to urlurlurlurlencodeencodeencodeencode for data resiliency http%2525253A%2525252F%2525252Fdiscatte.github.io

30 January at 5:06 | Open on digipres.club

Alastair McBain :unverified:

@discatte @xssfox I had a job posting that septuple escaped '(' and ')' from the job title to create the URL slug.

I had to file it, and my state's firewall decided it was malicious and blocked me from adding it to my list. 😅

30 January at 5:50 | Open on woof.tech

Simon (a 🐮 in 🇳🇿)

@xssfox Don't worry, I wonder if I screwed up something either way.

30 January at 5:08 | Open on cloudisland.nz

via unreachable

@xssfox I like showing people's projects to my friend JosÃ© (null) [object Object]

30 January at 5:21 | Open on tacobelllabs.net

pikmin loamy clay

@xssfox same energy

30 January at 5:36 | Open on tacobelllabs.net

𝕂ℕ𝔽 𝕀𝕆𝕆 ☎️

@nkizz @xssfox I would like to understand this joke

30 January at 6:44 | Open on sfba.social

HalJor :propride:

@knf100 @nkizz @xssfox https://www.explainxkcd.com/wiki/index.php/217:_e_to_the_pi_Minus_pi

30 January at 6:46 | Open on sfba.social

𝕂ℕ𝔽 𝕀𝕆𝕆 ☎️

@haljor @nkizz @xssfox thanks!

30 January at 6:48 | Open on sfba.social

groxx

@xssfox I occasionally end my emails with a J, just to screw with people that I know will notice

30 January at 6:00 | Open on hachyderm.io

m_eiman

@groxx @xssfox :) (but only in wingdings)

30 January at 8:43 | Open on mastodon.sdf.org

gkrnours

@xssfox monster :3

30 January at 6:08 | Open on mastodon.gamedev.place

embix

@xssfox @lisamelton and sprinkle in some zalgo text, while you’re at it

30 January at 6:26 | Open on norden.social

Michael Carroll

@xssfox Become unvalidatable

30 January at 6:36 | Open on mas.to

DELETED

@xssfox [Object object]

30 January at 6:37 | Open on mastodon.social

Tom

@fionnlagh @xssfox undefined

30 January at 7:22 | Open on mamot.fr

Pseudo Nym

@xssfox

Strong chaotic neutral energy here.

30 January at 6:40 | Open on mastodon.online

Maciej "XGQT" Barć

@xssfox

Insanely evil

30 January at 6:49 | Open on emacs.ch

Menno

@xssfox
Ooh! Elon, are you listening?
Someone came up with a new name for your next kid.

30 January at 7:45 | Open on ohai.social

Brent

@xssfox ಠ_ಠ

30 January at 8:44 | Open on mastodon.social

Fuchsiii~~~

@xssfox @littlefox

30 January at 8:51 | Open on oxytodon.com

Machaonix 🏴🏳️‍⚧️

@xssfox you are evil 😈 /j

30 January at 8:56 | Open on fandom.garden

Torben

@xssfox One can still improve "Put � in random text fields" - in text fields or labels that always have the same text, put � into random places, different ones each time.
Parsing errors suck but intermittent, seemingly random parsing errors from same input drive devs insane! Muhaha.

30 January at 8:58 | Open on mastodon.social

8941dc91-867e-4412-afd5-4698d32477be

@xssfox
Always try to keep the � at the beginning or end of your string

30 January at 9:22 | Open on infosec.exchange

Phil M0OFX 🔜 EMF 📞 3699

@xssfox Wow, that's pure evil...!

30 January at 9:27 | Open on digipres.club

Michael Westergaard

As the saying goes: life is a battle between developers trying to develop idiot-proof software and the universe trying to produce bigger idiots. This is a lovely new front of this very real and important conflict.

30 January at 9:29 | Open on westergaard.social

Dan Beeston

@xssfox MONSTER!!

30 January at 9:32 | Open on mastodon.social

JR Freeman

@xssfox
[object Object]
Is another good one.

30 January at 10:59 | Open on stranger.social

patter

@xssfox [Object]

30 January at 12:02 | Open on meow.social

Dreit

@xssfox Lorem ipsum dolor sit amet, consectetur adipisici elit, sed eiusmod tempor incidunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquid ex ea commodi consequat. Quis aute iure reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint obcaecat cupiditat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.