Bug Bounty Hunting Essentials

Bypassing filters using encoding

Sometimes, applications use filters to specific words using black or white lists. To avoid them, it is useful to encode the strings that you are using as a payload. For example, use HTML:

    <script>alert(1)</script>
    <script>alert(1)</script>

Both strings are the same, but if the application is using a black list to block the reserved words script or alert, it will be possible to bypass the filter using the encoded line in HTML.

Also, it is possible to use other kinds of encoding such as URL, Base64, hexadecimal, and so on.