Sto lavorando in Burp e ho ricevuto una risposta interessante quando invio una stringa decodificata come richiesta GET. Copia / incolla la stessa stringa in un browser, la stringa viene automaticamente codificata dal browser quando viene effettuata la richiesta.
È possibile inviare URI decodificati nei browser moderni?
La codifica è richiesta ed è la parte principale del modo in cui le funzioni URL per il server delle applicazioni ricevono la corretta forma di dati.
Se il tuo attacco non richiede l'interazione dell'utente come XSS, puoi semplicemente creare il tuo payload di attacco in python; nel caso rimanga lo stesso e l'attacco abbia luogo.
Se ti mancano le nozioni di base, puoi leggere l'articolo di seguito.
Encoding a URL
The most commonly encoded character in URL string is the <space> character. You see this character whenever you see a plus-sign (+) in a URL. This represents the space character. The plus sign acts as a special character representing that space in a URL. The most common way you'll see this is in a mailto link that includes a subject. If you want the subject to have spaces in it, you can encode them as pluses:
mailto:email?subject=this+is+my+subject
This bit of encoding text would transmit a subject of "this is my subject". The "+" character in the encoding would be replaced with an actual <space> when it is rendered in the browser.
To encode a URL, you simply replace the special characters with their encoding string. This will nearly always begin with a % character.
Encoding a URL
Strictly speaking, you should always encode any special characters found in a URL. One important note, in case you are feeling a bit intimidated by all this talk or encoding, is that you generally won't find any special characters in a URL outside their normal context except with form data.
Most URLs use the simple characters that are always allowed, so no encoding is needed at all.
If you submit data to CGI scripts using the GET method, you should encode the data as it will be sent over the URL. For instance, if you are writing a link to promote an RSS feed, your URL will need to be encoded to add to the script URL you're promoting it on.
What Should Be Encoded?
Any character that is not an alphabetic character, a number, or a special character that is being used outside its normal context is going to need to be encoded in your page. Below is a table of common characters that could be found in a URL and their encoding.
Reserved Characters URL Encoding
Character Purpose in URL Encoding
: Separate protocol (http) from address %3B
/ Separate domain and directories %2F
# Separate anchors %23
? Separate query string %3F
& Separate query elements %24
@ Separate username and password from domain %40
% Indicates an encoded character %25
+ Indicates a space %2B
<space> Not recommended in URLs %20 or +
Leggi altre domande sui tag web-browser chrome firefox web-application penetration-test