+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: Right-To-Left Override (RLO) Extension Spoofing: Hidden Dangers in File Names (/showthread.php?tid=6250636)
Right-To-Left Override (RLO) Extension Spoofing: Hidden Dangers in File Names - Aeon - Sep 1, 2023
Right-To-Left Override (RLO) Extension Spoofing is a deceptive technique that exploits the Unicode control character U+202E.
This character is typically used for bidirectional text formatting, but it's being weaponized to trick users.
The RLO Character:
The RLO character influences text display, making text appear right-to-left, commonly used in languages like Arabic and Hebrew.
Exploiting File Extensions:
Malicious actors use the RLO character cleverly within file names to manipulate how extensions are displayed.
Example: "invoice.pdf" becomes "invoice\u202Efdp.exe," visually appearing as "invoiceexe.pdf."
The Deception:
Users may see a harmless file when it's actually a dangerous executable.
The ".exe" extension is hidden, luring users into a false sense of security.