Fuzzing a website and came across an odd behavior. The site has a search bar, it sends queries via a GET request with the standard ?q= parameter. When I try the standard XSS payloads such as <script>alert(1);</script> I get a 403 error.

When I type a percent symbol in the search bar it just sanitizes it to ?q=%25 however when I enter the percent sign in the URL directly it doesn't seem to sanitize it (e.g. ?q=%).

When I send this query to the server it responds with an error page saying Uh-oh! We've got a problem on our end. When I enter %00 directly in the URL it gives me a page back with a blank search term.

Any ideas on what's going on?


% in the URL is the start of a URL encoded character - see Wikipedia: Percent Encoding for details. If you just enter a single % it is an invalid encoding which might explain the error page you see. If you enter %00 it means a character byte 0 (i.e. \000, \0, \x00 for typical notations of this "character"). This gets likely interpreted/sanitized as an empty search term since it does not contain any actual printable characters.

Not the answer you're looking for? Browse other questions tagged or ask your own question.