%3c has always been a friend of mine - The HP Security Laboratory Blog -
%3c has always been a friend of mine

Ask a developer what's the ASCII code of "A" and most should be able to tell you 65. The good ones will tell you 0x41. If you ask them they should be able to tell you some more off the top of their head. Space... 32, quote... 34, "a" ... 0x61 (I can never remember the base 10, hex was just easier for this). This isn't the coding equivalent of silly or pointless information like knowing all the Vice Presidents. Most developers have learned various ASCII codes over the course of their careers.I learned a lot of ASCII codes about 15 years ago while writing QBASIC apps when I needed to do things like PRINT "You entered " + CHR$(34) + $val + CHR$(34).

The same is true for web security professionals with URL encoded characters. Funny enough these are normally ASCII hex values but the characters you use so much that you memorize in web security are different than developers.The ones I have used so much I know by heart at %3c %3e %2f and %2e.

%3c = <

%3e = >

%2f = /

%2e = .

What URL encoded characters have you used so often that you know off the top of your head?


Posted 09-17-2009 3:59 PM by billyhoffman

Comments

Gilzow wrote re: %3c has always been a friend of mine
on 09-17-2009 6:21 PM

In addition to the ones you mentioned

%0A = new line

%26 = ampersand

Ory wrote re: %3c has always been a friend of mine
on 09-21-2009 7:50 AM

%27

MichaelSchratt wrote re: %3c has always been a friend of mine
on 10-02-2009 8:58 AM

Do not forget %25 :)

Martin Hall wrote re: %3c has always been a friend of mine
on 11-03-2009 5:34 PM

%22

%2b

(those two can help in bypassing the basic aspx bracket filters).

Also some others of note

%00

and anything else that html can't usually render.

for example XML will have issues attempting to render



Most DB's can handle those but if the site takes the input from the DB unchecked it will fail at render time.

Add a Comment

(required)  
(optional)
(required)  
Remember Me?

Type the numbers and letters above: