Web Application Defender's Cookbook

Recipe 5-4: Identifying Use of Multiple Encodings

This recipe shows you how to identify the use of multiple encodings.

Ingredients

• OWASP AppSensor5
  • Unexpected Encoding Used
• ModSecurity
  • @rx operator

A method that attackers often use is to encode their attack payloads multiple times. If security analysis applies only a single decode and then applies inspection checks, the attack payload evades detection. For example, consider the following XSS payloads:

<script>alert('XSS')</script>
%3Cscript%3Ealert('XSS')%3C%2Fscript%3E

The first XSS payload would execute a typical JavaScript alert pop-up box and would easily be identified by basic signature detection checks for the string <script. In the second payload, the <, <, and / characters have been URL-encoded. However, most security filters apply an initial decode function that would also catch this payload. But what if an attacker applies double encoding, as in the following payload?

%253Cscript%253Ealert('XSS')%253C%252Fscript%253E 

In this payload, the percent character is itself URL-encoded to %25. If security inspection applies only a single decoding routine, it would not match <script. When conducting security filter checks on input, it is therefore paramount that the data be canonicalized into its simplest form before inspection. This means that normalization actions should run in an iterative fashion to ensure that any nested encodings are also normalized. Another option is to conduct a single decoding function and ...