{"id":54102,"date":"2019-12-18T00:00:00","date_gmt":"2019-12-17T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii"},"modified":"2020-02-18T14:02:04","modified_gmt":"2020-02-18T11:02:04","slug":"ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","title":{"rendered":"Hasonl\u00f3 Unicode-jel karakterek haszn\u00e1lata az azonos\u00edt\u00e1son val\u00f3 \u00e1tl\u00e9p\u00e9shez","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub lett<\/a><\/noindex> sebezhet\u0151 egy t\u00e1mad\u00e1ssal szemben, amely lehet\u0151v\u00e9 teszi a fi\u00f3khoz val\u00f3 hozz\u00e1f\u00e9r\u00e9s megszerz\u00e9s\u00e9t az e-mailben tal\u00e1lhat\u00f3 Unicode karakterek manipul\u00e1l\u00e1s\u00e1val. A probl\u00e9ma az, hogy egyes Unicode karakterek az als\u00f3- vagy fels\u0151bet\u0171s alakba t\u00f6rt\u00e9n\u0151 \u00e1tkonvert\u00e1l\u00e1skor norm\u00e1l karakterekk\u00e9 alakulnak, amelyek hasonl\u00f3ak a bet\u0171form\u00e1jukban (amikor t\u00f6bb k\u00fcl\u00f6nb\u00f6z\u0151 karakter egy karakterr\u00e9 alakul — p\u00e9ld\u00e1ul a t\u00f6r\u00f6k \u200b\u200bkarakter «ı» \u00e9s «i» fels\u0151bet\u0171s alakban «I»-re alakul).<\/p>\n

Bizonyos szolg\u00e1ltat\u00e1sokban \u00e9s alkalmaz\u00e1sokban a felhaszn\u00e1l\u00f3 \u00e1ltal megadott adatok el\u0151sz\u00f6r \u00e1talak\u00edt\u00e1sra ker\u00fclnek kis- vagy nagybet\u0171s form\u00e1ba, majd ezt k\u00f6vet\u0151en ellen\u0151rzik az adatb\u00e1zisban. Ha a szolg\u00e1ltat\u00e1s enged\u00e9lyezi a unicode-karakterek haszn\u00e1lat\u00e1t a bejelentkez\u00e9sben vagy az e-mailben, akkor a t\u00e1mad\u00f3 hasonl\u00f3 unicode-karaktereket haszn\u00e1lhat a t\u00e1mad\u00e1s v\u00e9grehajt\u00e1s\u00e1ra, amely manipul\u00e1lja a karakterek kis- \u00e9s nagybet\u0171s \u00e1talak\u00edt\u00e1si \u00fctk\u00f6z\u00e9seit (Unicode Case Mapping Collisions). <\/p>\n

‘ß’.toUpperCase() == ‘ss’.toUpperCase() \\\/\\\/ 0x0131
\n ‘K’.toLowerCase() == ‘K’.toLowerCase() \\\/\\\/ 0x212A
\n ‘John@Gıthub.com’.toUpperCase() == ‘John@Github.com’.toUpperCase()<\/p>\n

A GitHub t\u00e1mad\u00f3ja k\u00e9pes volt<\/a><\/noindex> a jelsz\u00f3 helyre\u00e1ll\u00edt\u00e1si \u0171rlapon kereszt\u00fcl kezdem\u00e9nyezni egy k\u00f3d megk\u00fcld\u00e9s\u00e9t egy m\u00e1sik e-mail c\u00edmre, az \u0171rlapon egy unicode-karaktert haszn\u00e1lva, amely \u00fctk\u00f6z\u00e9st okoz (p\u00e9ld\u00e1ul mike@example.org helyett egy olyan e-mail c\u00edmet adott meg, amely mı<\/b>ke@example.org). Az e-mail c\u00edm azon az alapon ment \u00e1t az ellen\u0151rz\u00e9sen, hogy nagybet\u0171ss\u00e9 alakult, \u00e9s egyezett az eredeti c\u00edmmel (mike@example.org), de a k\u00fcld\u00f6tt lev\u00e9lben az c\u00edm alaphelyzetben szerepelt, \u00e9s a helyre\u00e1ll\u00edt\u00f3 k\u00f3d a hamis c\u00edmre ment (mı<\/b>ke@example.org).<\/p>\n

N\u00e9h\u00e1ny olyan karakter, karaktert<\/a><\/noindex>amely \u00fctk\u00f6z\u00e9st okoz a kis- \u00e9s nagybet\u0171 \u00e1tv\u00e1lt\u00e1sakor:<\/p>\n

ß \t0x00DF \tSS
\n ı \t0x0131 \tI
\n ſ \t0x017F \tS
\n ff \t0xFB00 \tFF
\n fi \t0xFB01 \tFI
\n fl \t0xFB02 \tFL
\n ffi \t0xFB03 \tFFI
\n ffl \t0xFB04 \tFFL
\n ſt \t0xFB05 \tST
\n st \t0xFB06 \tST
\n K \t0x212A \tk<\/p>\n

<\/a><\/noindex><\/p>\n

Forr\u00e1s: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d \u0430\u0442\u0430\u043a\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 Unicode-\u0441\u0438\u043c\u0432\u043e\u043b\u0430\u043c\u0438 \u0432 email. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u044b Unicode \u043f\u0440\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043d\u0438\u0436\u043d\u0438\u0439 \u0438\u043b\u0438 \u0432\u0435\u0440\u0445\u043d\u0438\u0439 \u0440\u0435\u0433\u0438\u0441\u0442\u0440 \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 \u043e\u0431\u044b\u0447\u043d\u044b\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u044b, \u0431\u043b\u0438\u0437\u043a\u0438\u0435 \u043f\u043e \u043d\u0430\u0447\u0435\u0440\u0442\u0430\u043d\u0438\u044e (\u043a\u043e\u0433\u0434\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 \u043e\u0434\u0438\u043d \u0441\u0438\u043c\u0432\u043e\u043b — \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0442\u0443\u0440\u0435\u0446\u043a\u0438\u0439 \u0441\u0438\u043c\u0432\u043e\u043b «ı» \u0438 «i» […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-54102","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Hasonl\u00f3 Unicode-karakterek haszn\u00e1lata az azonos\u00edt\u00e1s megker\u00fcl\u00e9s\u00e9re | ProHoster","description":"A GitHub t\u00e1mad\u00e1snak volt kit\u00e9ve, amely lehet\u0151v\u00e9 tette a fi\u00f3khoz val\u00f3 hozz\u00e1f\u00e9r\u00e9s megszerz\u00e9s\u00e9t a manipul\u00e1ci\u00f3 sor\u00e1n.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0445\u043e\u0436\u0438\u0445 Unicode-\u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"GitHub \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d \u0430\u0442\u0430\u043a\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-17T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54102","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 10:02:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:12:23","updated":"2026-01-24 10:02:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/54102","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=54102"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/54102\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=54102"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=54102"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=54102"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}