6

I got a phishing email from a supposed realtor that wanted me to click on the following link

http://wonderit.net/f%23$%25%5e%29%28*%5e%25$%25%5eamg*&%5e%25$%23$%25%5e/

which I decoded as:

http://wonderit.net/f#$%^)(*^%$%^amg*&^%$#$%^/

I was curious about the URL query or command because I haven't seen one like this before. Can someone explain to me how this malicious link works? Is f#$%^)(*^%$%^amg*&^%$#$%^/ an encoding of some sort? Or is it something designed to attack this server? Is it a bash script or some other command?

PS. Of course, I haven't tried to open the page at all

  • 1
    Surprisingly enough that is almost a valid folder name, when I tested it f#$%^)(*^%$%^amg*&^%$#$%^ changed to f#$%^)(*^%$%^amg*&^%0$%^. Is it possible that this is a ReDoS attack designed to hit whatever framework they are using? – Aedazan Nov 10 '16 at 1:06
2

The actual page requested would be http://wonderit.net/f, since anything after # would be interpreted by the DOM. That page returns HTTP status 406 with or without the hash mark and everything following. The site itself appears to be broken, so it's unlikely we can find out now what the intended result would've been.

  • 2
    No, the whole point of encoding is to be able to send special characters in the url to the server. In this case, because the hash mark is encoded as %23 it does get sent to server. But I agree: we will never find out the intended result. – Jeff Feb 24 '17 at 19:12
  • That's a very good point – Nstr10 Feb 24 '17 at 19:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.