https://blog.dansec.vip/tags/urldecode/ Recent content in URLdecode on Dan`s Blog Hugo zh-CN Mon, 17 Jun 2024 17:17:19 +0800 https://blog.dansec.vip/p/doubleurldecodetrick/ Mon, 17 Jun 2024 17:17:19 +0800 https://blog.dansec.vip/p/doubleurldecodetrick/ <p>FYI.</p> <p><code>file_put_content()</code>会默认进行一次<code>urldecode</code>，<code>php</code>接收时也会默认进行一次</p> <p>此为默认的二次<code>URLdecode</code>场景</p> <h2 id="常规二次urldecode">常规二次UrlDecode</h2> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">%2569 -&gt; %69 -&gt; i </span></span></code></pre></td></tr></table> </div> </div><h2 id="小技巧">小技巧</h2> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">%6%39 -&gt; %69 -&gt; i </span></span></code></pre></td></tr></table> </div> </div><h2 id="使用场景">使用场景</h2> <p>bypass WAF 对于 <code>%25</code> 的过滤</p>