Skip to content

Quick Reference For Web Hacking Tricks (UTF-8, WAF Bypasses, etc)

Notifications You must be signed in to change notification settings

scramblr/Web-Hacking-Quick-Ref

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
 
 
 
 

Repository files navigation

Created By: SCRAMBLR (blackout)
Updated: January 10 2026

These lil' "nothing characters" can - and frequently do - cause complete chaos in everything from backend databases, massive data warehousing systems, and other hilarious things that foolish and arrogant administrators will often overlook - even when staring directly at "the problem" because it's not visible to people who do not take a moment to think outside of their comfort zones. I have yet to find an environment or company that doesn't get completely humbled by these lil' bundles of joy.

👻 INVISIBLE & ZERO WIDTH UTF-8 TEXT 👻

NAME Code UTF-8 Width Effect Example (Escaped + URL)
ZERO WIDTH NON-JOINER (ZWNJ)
U+200C E2 80 8C 0
Zero-width format; Bypasses Minimum Character Filters, Creates Blank Replies, Works Everywhere.
Ye\u200Cs
Ye%E2%80%8Cs
WORD JOINER
U+2060 E2 81 A0 0
Similar to ZWNJ + Prevents line breaks
token\u2060token
token%E2%81%A0token
INVISIBLE SEPARATOR
U+2063 E2 81 A3 0
Invisible Separator; Another Variant, Never Filtered
A\u2063B
A%E2%81%A3B
INVISIBLE PLUS
U+2064 E2 81 A4 0
Sexy Invisible Operator-Like Format. ;)
1\u20642
1%E2%81%A42
ZERO WIDTH SPACE (ZWSP)
U+200B E2 80 8B 0
Can Cause Break; Sometimes Filtered.
Ye\u200Bs
Ye%E2%80%8Bs
ZERO WIDTH JOINER (ZWJ)
U+200D E2 80 8D 0
Variant of ZWNJ but with Glyph/emojis
👩\u200D💻
%F0%9F%91%A9%E2%80%8D%F0%9F%92%BB
SOFT HYPHEN
U+00AD C2 AD 0
Invisible - or hyphen, can be used instead of getting cockblocked by WAF
hy\u00ADphen
hy%C2%ADphen
MONGOLIAN VOWEL SEPARATOR
U+180E E1 A0 8E 0
Another variant of ZWNJ, older-school format.
A\u180EB
A%E1%A0%8EB
COMBINING GRAPHEME JOINER
U+034F CD 8F 0
Invisible combining mark.
e\u034F\u034F
e%CD%8F%CD%8F
LINE SEPARATOR
U+2028 E2 80 A8 newline
Unicode line break
ok\u2028WARN
ok%E2%80%A8WARN
PARAGRAPH SEPARATOR
U+2029 E2 80 A9 newline
Unicode paragraph break
hi\u2029next
hi%E2%80%A9next
NEXT LINE (NEL)
U+0085 C2 85 newline
Attempt for newline via C1 newline control
a\u0085b
a%C2%85b
NO-BREAK SPACE (NBSP)
U+00A0 C2 A0 space
Not trimmed like ASCII
a\u00A0b
a%C2%A0b
NARROW NO-BREAK SPACE
U+202F E2 80 AF thin
Narrow NBSP
1\u202F000
1%E2%80%AF000
HAIR SPACE
U+200A E2 80 8A hair
Extremely thin space (still visible tho)
a\u200Ab
a%E2%80%8Ab
IDEOGRAPHIC SPACE
U+3000 E3 80 80 wide
Full-width space so it's kinda dumb tbh.
a\u3000b
a%E3%80%80b
BOM / ZWNBSP
U+FEFF EF BB BF 0
Hidden BOM prefix (not always allowed)
\uFEFFadmin
%EF%BB%BFadmin




🔄🔃 Right-to-Left & Typing KungFu (BiDi) 🔃🔄

NOTE: PDF = Return back to normal writing

Name Code UTF-8 Width Effect Example (Literal + URL)
LEFT-TO-RIGHT EMBEDDING (LRE) U+202A E2 80 AA 0 Start Left-2-Right embedding abc\u202A123\u202Cdef
abc%E2%80%AA123%E2%80%ACdef
RIGHT-TO-LEFT EMBEDDING (RLE) U+202B E2 80 AB 0 Start Right-2-Left embedding abc\u202B123\u202Cdef
abc%E2%80%AB123%E2%80%ACdef
POP DIRECTIONAL FORMATTING (PDF) U+202C E2 80 AC 0 End embedding/override ...\u202Etxt\u202C...
...%E2%80%AEtxt%E2%80%AC...
LEFT-TO-RIGHT OVERRIDE (LRO) U+202D E2 80 AD 0 Force LTR rendering until PDF ab\u202Dcd\u202Cef
ab%E2%80%ADcd%E2%80%ACef
RIGHT-TO-LEFT OVERRIDE (RLO) U+202E E2 80 AE 0 Force RTL rendering until PDF abc\u202Etxt\u202Cdef
abc%E2%80%AEtxt%E2%80%ACdef
LEFT-TO-RIGHT ISOLATE (LRI) U+2066 E2 81 A6 0 LTR isolate A\u2066B\u2069C
A%E2%81%A6B%E2%81%A9C
RIGHT-TO-LEFT ISOLATE (RLI) U+2067 E2 81 A7 0 RTL isolate A\u2067B\u2069C
A%E2%81%A7B%E2%81%A9C
FIRST STRONG ISOLATE (FSI) U+2068 E2 81 A8 0 Direction inferred by first strong char A\u2068שלום\u2069B
A%E2%81%A8
%D7%A9%D7%9C%D7%95%D7%9D%E2%81%A9B
POP DIRECTIONAL ISOLATE (PDI) U+2069 E2 81 A9 0 End isolate ...\u2067RTL\u2069...
...%E2%81%A7RTL%E2%81%A9...
ARABIC LETTER MARK (ALM) U+061C D8 9C 0 Arabic letter mark (swaps directionality) A\u061CB
A%D8%9CB
LEFT-TO-RIGHT MARK (LRM) U+200E E2 80 8E 0 Nudge LTR rendering A\u200EB
A%E2%80%8EB
RIGHT-TO-LEFT MARK (RLM) U+200F E2 80 8F 0 Nudge RTL rendering A\u200FB
A%E2%80%8FB

About

Quick Reference For Web Hacking Tricks (UTF-8, WAF Bypasses, etc)

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published