6

I got a phishing email from a supposed realtor that wanted me to click on the following link

http://wonderit.net/f%23$%25%5e%29%28*%5e%25$%25%5eamg*&%5e%25$%23$%25%5e/

which I decoded as:

http://wonderit.net/f#$%^)(*^%$%^amg*&^%$#$%^/

I was curious about the URL query or command because I haven't seen one like this before. Can someone explain to me how this malicious link works? Is f#$%^)(*^%$%^amg*&^%$#$%^/ an encoding of some sort? Or is it something designed to attack this server? Is it a bash script or some other command?

PS. Of course, I haven't tried to open the page at all

Improve this question
1
  • 1
    Surprisingly enough that is almost a valid folder name, when I tested it f#$%^)(*^%$%^amg*&^%$#$%^ changed to f#$%^)(*^%$%^amg*&^%0$%^. Is it possible that this is a ReDoS attack designed to hit whatever framework they are using?
    – Aedazan
    Nov 10, 2016 at 1:06

1 Answer 1

Reset to default
2

The actual page requested would be http://wonderit.net/f, since anything after # would be interpreted by the DOM. That page returns HTTP status 406 with or without the hash mark and everything following. The site itself appears to be broken, so it's unlikely we can find out now what the intended result would've been.

Improve this answer
2
  • 2
    No, the whole point of encoding is to be able to send special characters in the url to the server. In this case, because the hash mark is encoded as %23 it does get sent to server. But I agree: we will never find out the intended result.
    – Jeff
    Feb 24, 2017 at 19:12
  • That's a very good point
    – CrunchBangDev
    Feb 24, 2017 at 19:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.