Buying a single character domain – and 3 character FQDN – for £15 – Terence Eden’s Blog

Theme Switcher:

🌒 Dark

🌞 Light

📰 eInk

💻 xterm

🥴 Drunk

👻 Nude

♻️ Reset

Short domains are useful for security testing. If you only have a limited number of characters, you need to be able to reference code on a remote server in as few characters as possible.

A few years ago, I tried to find a Minimum Viable XSS. The conclusion that I (and others) came to is that 20 characters is the bare minimum. But it requires you have a 2 character domain name on a 2-character TLD. Something like xy.uk

I don't think any 1- or 2-character domain names are available. If they're for sale, it will be at extortionate price. There are no Top-Level Domains shorter than 2 characters.

So, let's cheat!

This is the story of how I bought a single character domain, and am able to reference it in 3 characters, for the cost of a round of drinks.

Brief History

As I discussed in Domain hacks with unusual Unicode characters - there are a bunch of single Unicode codepoints which are normalised to 2- or 3-character sequences.

For example, ㎐ is the scientific symbol for Hertz. It is a single codepoint (U+3390). When your browser sees it in a domain name, it automatically splits it into the H and z characters. This is called decomposition.

Based on my count, there are about 90 symbols which decompose into 2 characters - for example ™, ㏄, dz.<br>There are about 35 symbols which decompose into 3 characters - for example ㎪, ㍹, ffi.

But, as mentioned, it is almost impossible to find a cheap 2- or 3-letter domain name.

There are, however, a couple of four character decompositions!

Quidquid latine dictum sit, altum videtur

The Romans didn't use a positional number system. The number 1 was Ⅰ, the number 2 was Ⅱ, the number 9 was Ⅸ.

But - look closely! The Ⅰ is not the English letter I - it is its own, separate, Unicode character (U+2160). And Ⅱ is not two Ⅰs smushed together, it is (U+2161).

When decomposed, however, they return to English letters.

What's the longest Roman numeral captured in a single codepoint?

The number 8 is Ⅷ (U+2167) - which decomposes to V I I I. Four characters!

but apart from the sanitation, the medicine, education, wine, public order, irrigation, roads, a fresh water system, public health, and a number system suitable for character decomposition what have the Romans ever done for us?

tl;dr TLD

There are a number of Top-Level Domains which can also be represented by a single character.

For example, Australia's TLD .au can be represented by the Astronomical Unit sign ㍳ (U+3373).

Most of those domains were expensive, or unavailable. But I found one which was both cheap and available.

Yes! The orthographic ligature of fi decomposes to f and i. That's the TLD for Finland.

I was able to register a Finnish domain on Gandi for £15.

Ⅷ.fi

🔗

That's Roman Numeral Eight (U+2167), dot (U+002E), Latin Small Ligature Fi (U+FB01).

Is this useful?

This gives me a Minimum Viable XSS in eighteen characters!

I'm pretty sure that's the shortest possible sequence!

Or, for loading remote resources in 15 characters:

There aren't many sites which are secured only by using a restricted character count - thankfully! But shrunk domains can also be useful for evading all sorts of filters.

Other domains are available

There's one other 4-character decomposition available - see if you can find it!

There are a few shrinkable TLDs which still have some of the 2- and 3-character domains available, but they are extortionately priced.

If you do grab one of these, and make something cool with it, please let me know.

Support this blog

If you've learned something from my blog posts, here's how you can return the favour:

Buy me something nice from my Amazon wishlist

Support me on Ko-Fi

Share this post on…

try {<br>await navigator.share({url:u});<br>} catch {<br>// Show an alert if the share failed. Likely means no share support.<br>alert('Copied URl to clipboard');<br>})()" style=cursor:pointer;>

Voluntary Paywall

Enjoyed this post? Show your support and pay the author.

19 thoughts on “Buying a single character domain - and 3 character FQDN - for £15”

Matt

Is it kcal? U+3389 nice article!

Reply 2020-08-15 12:58

Neil Brown

Clever!

Reply | Reply to original comment on twitter.com 2020-08-15 13:12

Michæl Brunton-Spall

Yay. I knew it would be something like this. That’s cute.

Reply | Reply to original comment on twitter.com 2020-08-15 13:16

Esko Reinikainen 🇪🇺🇫🇮💯

Looks like .fi domains are versatile.

Reply | Reply to original comment on twitter.com 2020-08-15 13:36

gorzilla

I’m surprised to learn there are chars that expand into slashes. That seems like it could be really useful but I’m not sure what for 🤔

Reply | Reply to original comment on twitter.com 2020-08-15 14:31

HackerNewsTop10

Buying a single character domain – and 3 character FQDN – for £15Link: shkspr.mobi/blog/2020/08/b…Comments:...