Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I was practising some labs to get better at XSS and SSRF. I found that sometimes I just encode characters once and the security filter is bypassed and occasionally I have to encode it two times.
How does the filter work in the backend? Can someone explain with a scenario?
It depends on particular implementation. The simple ones check one level only. The normal ones decode the request as many times as it was encoded: Check, decode, check, decode, etc., until the result of decoding is equal to the input of decoding.
