The Unicode character ㎣ (U+33A3) stands for cubic millimeters. During domain resolution, modern web browsers apply NFKC compatibility mapping. This process expands the single character into three distinct ASCII characters: mm3.
Because of this normalization step, navigating to ㎣.uk maps directly to mm3.uk.
Below is a protocol relative script injection payload. It takes 19 characters total.
Clicking the button below creates and appends this script element into the document head. The browser resolves //㎣.uk to mm3.uk, fetches the script, and executes the alert payload.
This expansion property offers utility across security testing and input constraints:
- • Length Constraints: Passing multi-character hostnames within restrictive byte limits.
- • Validation Bypasses: Circumventing strict string or regex filters that fail to account for Unicode normalization before resolving hostnames.