3

I am learning about web security, but I'm very confused about URL Encoding.

On PortSwigger, I learned that the URL http://127.0.0.1/admin can be written as http://127.0.0.1/%2561dmin by encoding a as %61 and then encoding % again, thus making it %2561

When I try this on my local computer, single URL encoding works. http://127.0.0.1/%61dmin is interpreted as http://127.0.0.1/admin

But double URL encoding does not work. http://127.0.0.1/%2561dmin becomes http://127.0.0.1/%61dmin

I am confused about how server knows how many times it has to decode the URL. And is this always the case or it will only works in some cases (as it didn't work on my localhost and some other places I've tried)?

Improve this question

1 Answer 1

Reset to default
3

So I am confused about how server knows how many time it have to decode URL

Always only once. And this is true for other encodings too, i.e. binary data in mails are encoded once with base64 or quoted-printable, unicode is encoded once with utf-8, HTML encoding is applied once for characters like < etc in HTML etc.

Improve this answer
3
  • Thanks for answering but as taught in this lab "portswigger.net/web-security/ssrf/…", I needed to use double-URL encoding for bypass filters.
    – Monu
    Mar 16, 2020 at 20:25
  • 2
    I find answer security.stackexchange.com/questions/185455/… which explains why double url encoding worked in above case.
    – Monu
    Mar 16, 2020 at 20:35
  • 1
    @Anni: yes, there might be a difference between how often the server should decode a URL vs. how often this is actually done due to errors, i.e. "...different parts of the applicaition makes different assumptions about if a variable is encoded or not...".
    – Steffen Ullrich
    Mar 16, 2020 at 20:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .