Fuzzing a website and came across an odd behavior. The site has a search bar, it sends queries via a GET request with the standard ?q= parameter. When I try the standard XSS payloads such as <script>alert(1);</script> I get a 403 error.

When I type a percent symbol in the search bar it just sanitizes it to ?q=%25 however when I enter the percent sign in the URL directly it doesn't seem to sanitize it (e.g. ?q=%).

When I send this query to the server it responds with an error page saying Uh-oh! We've got a problem on our end. When I enter %00 directly in the URL it gives me a page back with a blank search term.

Any ideas on what's going on?

closed as off-topic by Marcus Müller, MechMK1, Xander, Overmind, Tobi Nary Jul 2 at 5:55

This question appears to be off-topic. The users who voted to close gave these specific reasons:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Marcus Müller, Overmind, Tobi Nary
  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – MechMK1, Xander
If this question can be reworded to fit the rules in the help center, please edit the question.


% in the URL is the start of a URL encoded character - see Wikipedia: Percent Encoding for details. If you just enter a single % it is an invalid encoding which might explain the error page you see. If you enter %00 it means a character byte 0 (i.e. \000, \0, \x00 for typical notations of this "character"). This gets likely interpreted/sanitized as an empty search term since it does not contain any actual printable characters.

Not the answer you're looking for? Browse other questions tagged or ask your own question.