HostSplit - Exploitable Antipatterns in Unicode Normalization

Explore new exploit techniques leveraging Unicode normalization behavior to bypass URL security filters and enable domain impersonation in this 40-minute Black Hat conference talk. Delve into the HostSplit vulnerability, which allows attackers to create URL strings parsed as one hostname but resolved as another, moving beyond visual spoofing in internationalized domain names. Learn about vulnerable and non-vulnerable systems, testing methodologies, and best practices for mitigation. Presented by Jonathan Birch, this talk covers introduction, agenda, HostSplit explanation, vulnerability assessment, testing procedures, and recommended security practices.

Introduction
Agenda
HostSplit
Whats vulnerable
Whats not vulnerable
How to test
Best practices