🚀 Submit a Challenge — SecDim AppSec Village CTF at DEF CON 34 and Win a ROG Xbox Ally

Sign InContact sales
Sign InContact sales

Spotify BigBird

4h 20mIntermediateJavaC#JavaScriptPythonGoTypeScript

In mid-2013, Spotify fixed a security bug that could allow an adversary to take over any user's account. This also includes admin users! Let's find out what the security bug was and how to eliminate it in our programs.

Begin course

Topics

  1. Introduction to Unsafe Normaliser

    Video15m

    In June 2013, Spotify fixed a funny security bug that could have let a bad person take control of any user's account. The bug happened because Spotify didn't handle special letters like ☃ in usernames properly. This let the bad person mess things up.

  2. Unsafe Normaliser

    Lab40m

    Let’s head to the lab to discover, debug, and fix this vulnerability within an actual application.

    PythonJavaScriptTypeScriptGoJavaCsharp

  3. Lessons learnt - Unsafe Normaliser

    Lesson5m

    Unicode can be tricky, creating tricky situations. Picking the right normalizer and using it before checking strings can help us match what we want.