Stack Exchange Network
Stack Exchange network consists of 181 Q&A communities including
Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
Visit Stack Exchange
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Anybody can ask a question
The best answers are voted up and rise to the top
3 years, 5 months ago
I was practising some labs to get better at XSS and SSRF. I found that sometimes I just encode characters once and the security filter is bypassed and occasionally I have to encode it two times.
How does the filter work in the backend? Can someone explain with a scenario?
Dec 15, 2019 at 18:27
11 2 2 bronze badges
It depends on particular implementation. The simple ones check one level only. The normal ones decode the request as many times as it was encoded: Check, decode, check, decode, etc., until the result of decoding is equal to the input of decoding.
Dec 16, 2019 at 1:09
12.1k 5 5 gold badges 36 36 silver badges 50 50 bronze badges
log in to answer this question.
Not the answer you're looking for? Browse other questions tagged
By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our
Accept all cookies
Necessary cookies only