Skip to content

Miscmedium

Lookalikes Lurk in Unicode

150 points · 0 solved

Two strings that render identically are not necessarily identical.

Real:   sudosecurity.org
Fake:   sudоsecurity.org   <- the 'о' is U+043E CYRILLIC SMALL LETTER O

The flag is what a homoglyph scanner flags on sight: ss{lookalikes_lurk_in_unicode}

Material

Homoglyph/IDN phishing defeats eyeballs; normalize before comparing.

Hints0/2

Learn the technique/learn/web-app-security