3

I am learning about web security but very confused about URL Encoding, it will be big help if anyone can help.

On PortSwigger, I learned that url "http://127.0.0.1/admin" can be used as "http://127.0.0.1/%2561dmin" by encoding 'a' as '%61' and then encoding again % and it will become "%2561"

Now when I am trying on my local computer, then single URL encoding works "http://127.0.0.1/%61dmin"

But double URL encoding not works "http://127.0.0.1/%2561dmin"

So I am confused about how server knows how many time it have to decode URL, And is this always the case or it will only works in some cases as it not working in my localhost and some other places I tried.

Improve this question
3

So I am confused about how server knows how many time it have to decode URL

Always only once. And this is true for other encodings too, i.e. binary data in mails are encoded once with base64 or quoted-printable, unicode is encoded once with utf-8, HTML encoding is applied once for characters like < etc in HTML etc.

Improve this answer
  • Thanks for answering but as taught in this lab "portswigger.net/web-security/ssrf/…", I needed to use double-URL encoding for bypass filters. – Parvesh Monu Mar 16 '20 at 20:25
  • 1
    I find answer security.stackexchange.com/questions/185455/… which explains why double url encoding worked in above case. – Parvesh Monu Mar 16 '20 at 20:35
  • 1
    @Anni: yes, there might be a difference between how often the server should decode a URL vs. how often this is actually done due to errors, i.e. "...different parts of the applicaition makes different assumptions about if a variable is encoded or not...". – Steffen Ullrich Mar 16 '20 at 20:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.