Short domains are useful for security testing. If you only have a limited number of characters, you need to be able to reference code on a remote server in as few characters as possible.
A few years ago, I tried to find a Minimum Viable XSS. The conclusion that I (and others) came to is that 20 characters is the bare minimum. But it requires you have a 2 character domain name on a 2-character TLD. Something like
I don’t think any 1- or 2-character domain names are available. If they’re for sale, it will be at extortionate price. There are no Top-Level Domains shorter than 2 characters.
So, let’s cheat!
This is the story of how I bought a single character domain, and am able to reference it in 3 characters, for the cost of a round of drinks.
㎐ is the scientific symbol for Hertz. It is a single codepoint (U+3390). When your browser sees it in a domain name, it automatically splits it into the
z characters. This is called decomposition.
Based on my count, there are about 90 symbols which decompose into 2 characters – for example
There are about 35 symbols which decompose into 3 characters – for example
But, as mentioned, it is almost impossible to find a cheap 2- or 3-letter domain name.
There are, however, a couple of four character decompositions!
Quidquid latine dictum sit, altum videtur
The Romans didn’t use a positional number system. The number 1 was Ⅰ, the number 2 was Ⅱ, the number 9 was Ⅸ.
When decomposed, however, they return to English letters.
What’s the longest Roman numeral captured in a single codepoint?
The number 8 is
Ⅷ (U+2167) – which decomposes to V I I I. Four characters!
but apart from the sanitation, the medicine, education, wine, public order, irrigation, roads, a fresh water system, public health, and a number system suitable for character decomposition what have the Romans ever done for us?
There are a number of Top-Level Domains which can also be represented by a single character.
For example, Australia’s TLD
.au can be represented by the Astronomical Unit sign
Most of those domains were expensive, or unavailable. But I found one which was both cheap and available.
Yes! The orthographic ligature of
ﬁ decomposes to
i. That’s the TLD for Finland.
I was able to register a Finnish domain on Gandi for £15.
That’s Roman Numeral Eight (U+2167), dot (U+002E), Latin Small Ligature Fi (U+FB01).
Is this useful?
This gives me a Minimum Viable XSS in eighteen characters!
I’m pretty sure that’s the shortest possible sequence!
Or, for loading remote resources in 15 characters:
There aren’t many sites which are secured only by using a restricted character count – thankfully! But shrunk domains can also be useful for evading all sorts of filters.
Other domains are available
There’s one other 4-character decomposition available – see if you can find it!
There are a few shrinkable TLDs which still have some of the 2- and 3-character domains available, but they are extortionately priced.
If you do grab one of these, and make something cool with it, please let me know.
Support this blog
If you’ve learned something from my blog posts, here’s how you can return the favour: