Double encoding

Double encoding is the act of encoding data twice in a row using the same encoding scheme. It is usually used as an attack technique to bypass authorization schemes or security filters that intercept user input. In double encoding attacks against security filters, characters of the payload that are treated as illegal by those filters are replaced with their double-encoded form. Double URI-encoding is a special type of double encoding in which data is URI-encoded twice in a row. It has been used to bypass authorization schemes and security filters against code injection, directory traversal, cross-site scripting (XSS) and SQL injection.

Double encoding is the act of encoding data twice in a row using the same encoding scheme. It is usually used as an attack technique to bypass authorization schemes or security filters that intercept user input. In double encoding attacks against security filters, characters of the payload that are treated as illegal by those filters are replaced with their double-encoded form. Double URI-encoding is a special type of double encoding in which data is URI-encoded twice in a row. It has been used to bypass authorization schemes and security filters against code injection, directory traversal, cross-site scripting (XSS) and SQL injection. Double URI-encoding, also referred to as double percent-encoding, is a special type of double encoding in which data is URI-encoded twice in a row. In other words, double-URI-encoded form of data X is URI-encode(URI-encode(X)) . For example, for calculating double-URI-encoded form of , first is URI-encoded as %3C which then in turn is URI-encoded as %253C , that is, double-URI-encode( . As another example, for calculating double-URI-encoded form of ../ , first ../ is URI-encoded as %2E%2E%2F which then in turn is URI-encoded as %252E%252E%252F , that is, double-URI-encode(../) = URI-encode(URI-encode(../)) = URI-encode(%2E%2E%2F) = %252E%252E%252F . Double URI-encoding is usually used as an attack technique against web applications and web browsers to bypass authorization schemes and security filters that intercept user input. For example, because . and its URI-encoded form %2E are used in some directory traversal attacks, they are usually treated as illegal by security filters. However, it is still possible for %252E , which is the double-URI-encoded form of . , so as not to be treated as illegal by security filters and hence pass through them, but later on, when the target system is building the path related to the directory traversal attack it might use the double-URI-decoded form of %252E , which is . , something that the filters would have been treated as illegal. Double URI-encoding attacks have been used to bypass authorization schemes and security filters against code injection, directory traversal, XSS and SQL injection. This filter successfully blocks payloads such as ../../../../etc/passwd and its URI-encoded form %2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fetc%2Fpasswd However, when the aforementioned payload is doubly-encoded as %252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252Fetc%252Fpasswd it will bypass this filter, since the value of $_GET["file"] will be the singly-encoded version. When the payload is encoded once, it does not contain any directory traversal sequence and thus passes through the filter unchanged. Once it is given to the urldecode function, it will become ../../../../etc/passwd , resulting in a successful attack. This filter successfully blocks payloads such as alert(123) and its URI-encoded form %3Cscript%3Ealert%28123%29%3C%2Fscript%3E However, when the payload is doubly-encoded as %253Cscript%253Ealert%2528123%2529%253C%252Fscript%253E it will bypass this filter, since the value of $_GET["name"] will be the singly-encoded form. The singly-encoded form does not contain any illegal characters and will passes through the htmlentities function unchanged. Then, once the urldecode function decodes it a second time, it will become which results in a successful attack.

Text derived from https://en.wikipedia.org/w/index.php?oldid=1377505199 under CC BY-SA 4.0; modifications have been made.