Null byte attacks are alive and well
Summary: PortSwigger Research revisits null byte attacks, showing that a Java filename check ending in ".jpg" can be bypassed with input like secret.txt%00.jpg because managed code counts the full string length while native OS APIs truncate at the null byte. The post also describes null byte techniques against LDAP filters on Microsoft ADAM, where a query such as (&(displayName=*))%00)(department=Marketing)) gets truncated in native code, and against XPath queries, where the .NET System.Xml.XPath namespace does not block null bytes.
Key Takeaway: The same input-validation logic that looks correct in managed code - endsWith, LDAP filter construction, XPath queries - can be silently truncated once it reaches native APIs, and the post notes that ASP.NET's System.IO.File blocks null bytes while System.DirectoryServices and System.Xml.XPath do not.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026