Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Incomplete URL encoding

vpb | Last updated: Apr 21, 2020 10:36AM UTC

According to RFC3986 section 2.2, square brackets ('[',']') are reserved characters. Burp doesn't percent encode these characters when using the Ctrl+U hotkey, and one can observe Scanner payloads that don't have these characters encoded (this may or may not be intentional). Failing to encode the above characters at least results in Tomcat dropping the messages with error 400 without forwarding the data to the target application. I also tried to URL-encode the reserved character list from the RFC, and it seems that the following characters aren't encoded either: - Forward slash ("/") - Exclamation mark ("!") - Dollar sign ("$") - Round brackets ("(",")") - Asterisk ("*") - Comma (",") - Single quote ("'")

Uthman, PortSwigger Agent | Last updated: Apr 21, 2020 11:13AM UTC