Obfuscating attacks using encodings
Summary: PortSwigger Research describes how attackers evade input filters by exploiting mismatches between the decoding a WAF or filter performs and the decoding the back-end server or browser later applies, using URL, HTML, XML, Unicode, hex, and octal encodings. The article notes that double URL-encoding (replacing % with %25), leading zeros in HTML and ES6 Unicode code points, and SQL's CHAR() function can let payloads like XSS and SQL injection slip past filters that decode only once or match keywords literally.
What's compelling: The entire bypass rests on a single discrepancy: if your WAF decodes input once and your back-end decodes it twice, a payload like a double-encoded XSS string reaches the application unflagged, so the filter's decode logic has to match the server's exactly or it provides no protection.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026