UnUnicode
Summary: PortSwigger's BApp Store lists UnUnicode, a Burp Suite extension by godfuzz3r, version 1.3.0, last updated 08 July 2025, that unescapes Unicode-escaped sequences in HTTP requests and responses and in WebSocket messages. The extension is intended to reveal obfuscated payloads or identifiers that use multiple layers of Unicode escaping for manual inspection.
What's compelling: Attackers can stack multiple layers of Unicode escaping to hide payloads and identifiers from anyone reading raw traffic, and this extension exists specifically because that obfuscation defeats casual inspection. PortSwigger states the extension is written by a third-party user and carries no warranty of quality or usefulness, so the visibility it provides rests on code the vendor does not vouch for.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026