I want to ask about something called CAPEC \x4F, I know it has something to do with directory traversal characters' encoding, but I dont know anything else about it

closed as off-topic by Xander, Neil Smithline, Steffen Ullrich, TildalWave, Mark Buffalo Mar 12 '16 at 23:47

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Xander, Neil Smithline, Steffen Ullrich
If this question can be reworded to fit the rules in the help center, please edit the question.


CAPEC is the "Common Attack Pattern Enumeration and Classification". \x4F is hexadecimal for 79.

CAPEC-79: Using Slashes in Alternate Encoding is about encoding the slash character to bypass filters that should filter for directory traversal.

  • can you give me an example of slash character encoding please?, because I am trying to try a directory listing vulnerability on a wargame site, but that site has filtered the common methods to do the directory traversal thing – adib Mar 12 '16 at 17:39
  • Also how did you know that \x4F is hexadecimal for 79, I was using an converter from hex to text but it shows me the value O – adib Mar 12 '16 at 17:42
  • 1
    @adib The linked article names a couple of examples, eg using \ instead of /, URL encoding, utf8 encoding, etc. and \x just denotes that the following is hexadecimal (so you don't eg confuse \x11 with 11 (decimal), and 4F (hex) is 79 (dec). – tim Mar 12 '16 at 17:50
  • I have tried it, It doesn't work. It gives me an error saying Invalid url. But when I try %2F..%2F..%2Ftrojan_robot.txt it says permission denied – adib Mar 12 '16 at 18:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.