Technique Search Instance

HTTP 200 OK
Allow: GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "id": 356,
    "key": "right-to-left-override-rlo-extension-spoofing",
    "unprotect_id": "U1010",
    "name": "Right-to-Left Override (RLO) Extension Spoofing",
    "description": "The **Right-to-Left Override** (RLO) character (`U+202E`) is a Unicode control character used for bidirectional text formatting. It affects the way text is displayed, causing text following the RLO character to be rendered from right to left, which is typically used in languages like Arabic and Hebrew.\r\n\r\nHowever, malicious actors have found a way to exploit this Unicode character to deceive users by using it in file extensions. By strategically placing the RLO character within a file name, they can manipulate the visual appearance of the extension while maintaining its actual content.\r\n\r\nFor example, consider a file named \"invoice.pdf\" with the RLO character followed by malicious code: `invoice\\u202Efdp.exe`. When displayed in certain contexts, it may appear as `invoiceexe.pdf` (hiding the \".exe\" extension) instead of the actual \"invoice.pdf.exe\". This tactic aims to trick users into believing the file is harmless when, in reality, it could be a dangerous executable.",
    "resources": "",
    "creation_date": "2023-08-03T06:17:48.602000Z",
    "tags": "Extension, Spoof, RLO, Filename",
    "modification_date": "2024-01-15T00:01:09.968000Z",
    "category": [
        14
    ],
    "rules": [
        151
    ],
    "attachments": [],
    "featured_api": [],
    "contributors": [
        4,
        32
    ]
}