SOCKS5 hostname null-byte injection
Named by 2 kept items in this workspace.
Search every workspace for SOCKS5 hostname null-byte injection. It matches the name as written, so it can find other things that share it.
The items that name it 2
Attacker sends a hostname like attacker-host.com\x00.google.com; the filter sees the trailing .google.com in an allowlist policy (e.g. allow only *.google.com) and approves it, but the OS truncates at the null byte and dials attacker-host.com instead, bypassing the sandbox allowlist
Attacker embeds a null byte in a SOCKS5 CONNECT DOMAINNAME field, e.g. attacker-host.com\x00.google.com; JavaScript endsWith() allowlist check sees the trailing '.google.com' and allows it, while libc getaddrinfo() truncates the string at the null byte and resolves/dials the attacker's actual host,
All techniques in this workspace.