使用不常见 Unicode 字符的域名技巧(2018)
Domain hacks with unusual Unicode characters (2018)

原始链接: https://shkspr.mobi/blog/2018/11/domain-hacks-with-unusual-unicode-characters/

Unicode 包含可通过 IDNA2008 规范化为有效顶级域名的字符,因此可以写出 https://edent.℡/ 这样的 URL,而不是 https://edent.tel/。现代浏览器、curl 和 wget 会将这些特殊字符转换为标准 ASCII 域名,但 dig/host 等 DNS 工具不会,Twitter/Facebook 等平台也不会自动链接。通过 Word 复制粘贴可能保留上标形式并破坏解析。许多单个字符映射到国家代码或特殊顶级域名(例如,№→挪威,㍳→澳大利亚,™→土库曼斯坦)。虽然这能产生更酷、更短的 URL,但其效果不一致,还可能绕过 URL 过滤器。

Hacker News 的一个帖子链接到一篇关于使用不常见 Unicode 字符进行域名技巧的 2018 年文章。评论者讨论 HN 和浏览器如何破坏或屏蔽此类 URL,包括 Punycode 转换和 IDN 同形异义字保护。讨论涵盖 Unicode 规范化问题、网络钓鱼和同形字攻击的安全担忧,以及注册不常见或受限域名的趣闻。一些用户描述了零宽字符等变通方法,而另一些用户分享了映射到国家代码顶级域名的 Unicode 字符列表。总体而言,该帖子突出了在域名中使用 Unicode 的创意可能性以及技术和安全复杂性。
相关文章

原文

Unicode contains a range of symbols which don't get much use. For example, there are separate symbols for TradeMark - ™, Service Mark - ℠, and Prescriptions - ℞.

Nestling among the "Letterlike Symbols" are two curious entries. Both of these are single characters:

What's interesting is both .tel and .no are Top-Level-Domains (TLD) on the Domain Name System (DNS).

So my contact site - https://edent.tel/ - can be written as - https://edent.℡/

And the Norwegian domain name registry NORID can be accessed at https://www.norid.№/

Copy and paste those links - they work in any browser!

No! This works ANYWHERE in a domain name. Copy and paste these examples:

  • Script https://ℰ𝒳𝒜ℳ𝓟ℒℰ.𝒞𝓞ℳ/
  • Math Bold https://𝐞𝐱𝐚𝐦𝐩𝐥𝐞.𝐜𝐨𝐦/
  • Fraktur https://𝖊𝖝𝖆𝖒𝖕𝖑𝖊.𝖈𝖔𝖒/
  • Math bold italic https://𝒆𝒙𝒂𝒎𝒑𝒍𝒆.𝒄𝒐𝒎/
  • Math bold script https://𝓮𝔁𝓪𝓶𝓹𝓵𝓮.𝓬𝓸𝓶/
  • Double struck https://𝕖𝕩𝕒𝕞𝕡𝕝𝕖.𝕔𝕠𝕞/
  • Monospace https://𝚎𝚡𝚊𝚖𝚙𝚕𝚎.𝚌𝚘𝚖/
  • Super script https://ᵉˣᵃᵐᵖˡᵉ.ᶜᵒᵐ/
  • Sub script https://ₑₓₐₘₚₗₑ.cₒₘ/ NB not all characters supported
  • Math sans bold https://𝗲𝘅𝗮𝗺𝗽𝗹𝗲.𝗰𝗼𝗺/
  • Math sans bold italic https://𝙚𝙭𝙖𝙢𝙥𝙡𝙚.𝙘𝙤𝙢/
  • Math sans italic https://𝘦𝘹𝘢𝘮𝘱𝘭𝘦.𝘤𝘰𝘮/
  • Math Squared https://🄴🅇🄰🄼🄿🄻🄴.🄲🄾🄼/ NB the dot must not be squared
  • Circled https://ⓔⓧⓐⓜⓟⓛⓔ.ⓒⓞⓜ/ NB the dot must not be circled

There are a whole bunch more miscellaneous characters you can use:

Magic! Which is to say, I think it is the browser doing the conversion. DNS Servers don't successfully reply to queries about .℡ domains.

The browser sees the .℡ and then follows the IDNA2008 process listed in RFC5895 to normalise it:

map characters to the "Simple_Lowercase_Mapping" property (the fourteenth column) in <http://www.unicode.org/Public/UNIDATA/UnicodeData.txt>, if any.

The ℡ entry is:

2121;TELEPHONE SIGN;So;0;ON;<compat> 0054 0045 004C;;;;N;T E L SYMBOL;;;;

U+0054 is T, U+0045 is E, U+004C is L.

You can test this in Python using:

python -c 'import sys;print sys.argv[1].decode("utf-8").encode("idna")' "℡"

Yes! I asked people on Twitter whether they could access my website using a .℡ - and it appeared to work on every modern browser and operating system.

It even works on command line tools like wget and curl.

It does fail in some circumstances:

Two main ones:

  • Sites like Twitter and Facebook don't recognise it as a valid URl and refuse to auto link it.
  • Some command line tools like dig and host don't understand it
Copied Bash to 📋
 Bashdig edent.℡

; <<>> DiG 9.10.6 <<>> edent.℡
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 55282

Obviously yes. This may be the most important discovery of the decade. You get cool looking URls and get to save a couple of characters on specific domains, at the minor expense of working inconsistently.

It could also be used for evading URl filters.

Every modern browser supports these "fancy" domain names - but most websites won't automatically link to them. So sharing on Facebook doesn't work.

Here are the single characters which can be normalised down to a valid TLD. They're mostly country codes, but there are a few interesting exceptions:

  • ㏕ - US Military
  • ℡ - .tel registry
  • № - Norway
  • ㍳ - Australia
  • ㍷ - Dominica
  • ㎀ - Panama
  • ㎁ - Namibia
  • ㎃ - Morocco
  • ㎊ - French Polynesia
  • ㎋ - Norfolk Island
  • ㎏ - Kyrgyzstan
  • ㎖ - Mali
  • ㎙ - Federated States of Micronesia
  • fi - Finland
  • ㎜ - Myanmar
  • ㎝ - Cameroon
  • ㎞ & ㏎ - Comoros
  • ㎰ - Palestine
  • ㎳ - Montserrat
  • ㎷ & ㎹ - Republic of Maldives.
  • ㎺ - Palau
  • ㎽ & ㎿ - Malawi
  • ㏄ - Cocos (Keeling) Islands
  • ㏅ - Democratic Republic of Congo
  • ㏉ - Guyana
  • ㏗ - Philippines
  • ㏘ - Saint Pierre and Miquelon
  • ㏚ - Puerto Rico
  • ㏛ - Suriname
  • ㏜ - El Salvador
  • ℠ - San Marino
  • ™ - Turkmenistan
  • st & ſt - São Tomé and Príncipe
  • ㎇ - Great Britain ( Obsolete)
  • ß - South Sudan ( Not available)
  • ㏌ - India and Indiana (subdomain of .us)
  • Ⅵ & ⅵ - Virgin Islands and Virginia (subdomain of .us)
  • fl - Florida (subdomain of .us)
  • ㎚ - New Mexico (subdomain of .us)
  • ㎵ - Nevada (subdomain of .us)
  • ㍵ - As part of .ovh

If you can find any more, please stick a comment in the box below.

You can always reach this blog post at:

https://🅂𝖍𝐤ₛᵖ𝒓.ⓜ𝕠𝒃𝓲/🆆🆃🅵/


联系我们 contact @ memedata.com