I was practising some labs to get better at XSS and SSRF. I found that sometimes I just encode characters once and the security filter is bypassed and occasionally I have to encode it two times.

How does the filter work in the backend? Can someone explain with a scenario?

1 Answer 1


It depends on particular implementation. The simple ones check one level only. The normal ones decode the request as many times as it was encoded: Check, decode, check, decode, etc., until the result of decoding is equal to the input of decoding.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .