Fuzzing a website and came across an odd behavior. The site has a search bar, it sends queries via a
GET request with the standard
?q= parameter. When I try the standard XSS payloads such as
<script>alert(1);</script> I get a 403 error.
When I type a percent symbol in the search bar it just sanitizes it to
?q=%25 however when I enter the percent sign in the URL directly it doesn't seem to sanitize it (e.g.
When I send this query to the server it responds with an error page saying
Uh-oh! We've got a problem on our end. When I enter
%00 directly in the URL it gives me a page back with a blank search term.
Any ideas on what's going on?