{"id":54102,"date":"2019-12-18T00:00:00","date_gmt":"2019-12-17T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii"},"modified":"2020-02-18T14:02:04","modified_gmt":"2020-02-18T11:02:04","slug":"ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","title":{"rendered":"P\u00ebrdorimi i simboleve t\u00eb ngjashme Unicode p\u00ebr t\u00eb anashkaluar autentikimin","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub doli<\/a><\/noindex> i n\u00eb rrezik nga nj\u00eb sulm q\u00eb mund\u00ebson marrjen e aksesit n\u00eb llogarin\u00eb p\u00ebrmes manipulimit me simbolet Unicode n\u00eb email. Problemi lidhet me faktin se disa simbole Unicode, kur aplikohen funksionet p\u00ebr kthim n\u00eb shkronja t\u00eb vogla ose t\u00eb m\u00ebdha, p\u00ebrkthehen n\u00eb simbole t\u00eb zakonshme, t\u00eb ngjashme (kur disa simbole t\u00eb ndryshme p\u00ebrkthehen n\u00eb nj\u00eb simbol \u2014 p\u00ebr shembull, simboli turk «ı» dhe «i» kur konvertohen n\u00eb shkronja t\u00eb m\u00ebdha kthehen n\u00eb «I»).<\/p>\n

Para se t\u00eb kontrollohen parametrat e hyrjes n\u00eb disa sh\u00ebrbime dhe aplikacione, t\u00eb dh\u00ebnat e dor\u00ebzuara nga p\u00ebrdoruesi fillimisht transformohen n\u00eb shkronja t\u00eb m\u00ebdha ose t\u00eb vogla dhe pastaj kontrollohen n\u00eb DB. N\u00ebse sh\u00ebrbimi lejon p\u00ebrdorimin e simboleve unicode n\u00eb emrin e p\u00ebrdoruesit ose email, at\u00ebher\u00eb sulmuesi mund t\u00eb p\u00ebrdor\u00eb simbole unicode t\u00eb ngjashme p\u00ebr t\u00eb kryer nj\u00eb sulm q\u00eb manipulohet me kolizionet n\u00eb tabelat e transformimit t\u00eb shkronjave (Kolizionet e Mapimit t\u00eb Rastit Unicode). <\/p>\n

‘ß’.toUpperCase() == ‘ss’.toUpperCase() \\\/\\\/ 0x0131
\n ‘K’.toLowerCase() == ‘K’.toLowerCase() \\\/\\\/ 0x212A
\n ‘John@Gıthub.com’.toUpperCase() == ‘John@Github.com’.toUpperCase()<\/p>\n

N\u00eb GitHub, sulmuesi mund<\/a><\/noindex> p\u00ebrmes formularit t\u00eb rikuperimit t\u00eb fjal\u00ebkalimit t\u00eb humbur t\u00eb nxis\u00eb d\u00ebrgimin e nj\u00eb kodi rikuperimi n\u00eb nj\u00eb email tjet\u00ebr p\u00ebrmes p\u00ebrcaktimit n\u00eb formular t\u00eb nj\u00eb adrese q\u00eb p\u00ebrfshin nj\u00eb simbol unicode, duke shkaktuar nj\u00eb kolizion (p\u00ebr shembull, n\u00eb vend t\u00eb mike@example.org t\u00eb jepet email mı<\/b>ke@example.org). Adresa kalonte kontrollin pasi transformohej n\u00eb shkronja t\u00eb m\u00ebdha dhe p\u00ebrputhej me adres\u00ebn fillestare (mike@example.org), por gjat\u00eb d\u00ebrgimit t\u00eb emailit, ajo vendosej ashtu si\u00e7 ishte dhe kodi i rikuperimit shkon te adresa e falsifikuar (mı<\/b>ke@example.org).<\/p>\n

Disa nga simbol\u00ebt<\/a><\/noindex>, q\u00eb shkaktojn\u00eb kolizione gjat\u00eb transformimit t\u00eb rastit:<\/p>\n

ß \t0x00DF \tSS
\n ı \t0x0131 \tI
\n ſ \t0x017F \tS
\n ff \t0xFB00 \tFF
\n fi \t0xFB01 \tFI
\n fl \t0xFB02 \tFL
\n ffi \t0xFB03 \tFFI
\n ffl \t0xFB04 \tFFL
\n ſt \t0xFB05 \tST
\n st \t0xFB06 \tST
\n K \t0x212A \tk<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d \u0430\u0442\u0430\u043a\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 Unicode-\u0441\u0438\u043c\u0432\u043e\u043b\u0430\u043c\u0438 \u0432 email. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u044b Unicode \u043f\u0440\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043d\u0438\u0436\u043d\u0438\u0439 \u0438\u043b\u0438 \u0432\u0435\u0440\u0445\u043d\u0438\u0439 \u0440\u0435\u0433\u0438\u0441\u0442\u0440 \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 \u043e\u0431\u044b\u0447\u043d\u044b\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u044b, \u0431\u043b\u0438\u0437\u043a\u0438\u0435 \u043f\u043e \u043d\u0430\u0447\u0435\u0440\u0442\u0430\u043d\u0438\u044e (\u043a\u043e\u0433\u0434\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 \u043e\u0434\u0438\u043d \u0441\u0438\u043c\u0432\u043e\u043b — \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0442\u0443\u0440\u0435\u0446\u043a\u0438\u0439 \u0441\u0438\u043c\u0432\u043e\u043b «ı» \u0438 «i» […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-54102","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47P\u00ebrdorimi i simboleve Unicode t\u00eb ngjashme p\u00ebr t\u00eb kaluar autentifikimin | ProHoster","description":"GitHub u ekspozua ndaj nj\u00eb sulmi q\u00eb lejon qasjen n\u00eb llogari p\u00ebrmes manipulimit me.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0445\u043e\u0436\u0438\u0445 Unicode-\u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"GitHub \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d \u0430\u0442\u0430\u043a\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-17T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54102","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 10:02:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:12:23","updated":"2026-01-24 10:02:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/54102","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=54102"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/54102\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=54102"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=54102"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=54102"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}