This means that, as far as most servers are concerned, sequences like %22, %3D, and %3E in a query parameter are synonymous with ', characters respectively. This ensures that the ampersand will not be mistaken for a delimiter.Īlthough the space character can be encoded as %20, it is often represented by a plus ( +) instead, as in the example above.Īny URL-based input is automatically URL decoded server-side before it is assigned to the relevant variables. This usually means substituting them with a % character and their 2-digit hex code as follows:

What happens if the user searches for something like 'Fish & Chips'?īrowsers automatically URL encode any characters that may cause ambiguity for parsers. Consider a parameter containing a user's search query. The problem is, URL-based inputs may contain these characters for a different reason. For example, an ampersand ( &) is used as a delimiter to separate parameters in the query string. In URLs, a series of reserved characters carry special meaning. Any discrepancy can enable an attacker to sneak harmful payloads past the filter by applying different encodings that will automatically be removed later. From a security perspective, it's vital that the decoding performed when checking the input is the same as the decoding performed by the back-end server or browser when it eventually uses the data. However, these kinds of input filters also need to decode the input in order to check whether it's safe or not. As the inputs for these payloads are almost never expected to contain user-supplied code or markup, websites often implement defences that block requests containing these suspicious patterns. Injection attacks often involve injecting payloads that use recognizable patterns, such as HTML tags, JavaScript functions, or SQL statements. If you can infer how your input is being decoded based on this context, you can potentially identify alternative ways to represent the same payload. When constructing an attack, you should think about where exactly your payload is being injected. For example, a query parameter is typically URL decoded server-side, while the text content of an HTML element may be HTML decoded client-side. The exact sequence of decoding steps that are performed depends on the context in which the data appears. When they want to actually use the data, this often means they have to decode it first. In this section, we'll show you how you can take advantage of the standard decoding performed by websites to evade input filters and inject harmful payloads for a variety of attacks, such as XSS and SQL injection.īoth clients and servers use a variety of different encodings to pass data between systems.

Url encode for colon