> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/web/miscellaneous/url-encoding.md). # URL Encoding URL encoding, officially known as percent-encoding, is a method to [encode](https://en.wikipedia.org/wiki/Binary-to-text_encoding) arbitrary data in a [uniform resource identifier](https://en.wikipedia.org/wiki/Uniform_resource_identifier) (URI) using only the [US-ASCII](https://en.wikipedia.org/wiki/ASCII) characters legal within a URI. Although it is known as *URL encoding*, it is also used more generally within the main [Uniform Resource Identifier](https://en.wikipedia.org/wiki/Uniform_Resource_Identifier) (URI) set, which includes both [Uniform Resource Locator](https://en.wikipedia.org/wiki/Uniform_Resource_Locator) (URL) and [Uniform Resource Name](https://en.wikipedia.org/wiki/Uniform_Resource_Name) (URN). Consequently, it is also used in the preparation of data of the `application/x-www-form-urlencoded` [media type](https://en.wikipedia.org/wiki/Media_type), as is often used in the submission of [HTML](https://en.wikipedia.org/wiki/HTML) [form](https://en.wikipedia.org/wiki/Form_\(web\)) data in [HTTP](https://en.wikipedia.org/wiki/HTTP) requests. ## Reserved characters
!#$&'()*+,/:;=?@[]
%21%23%24%26%27%28%29%2A%2B%2C%2F%3A%3B%3D%3F%40%5B%5D
## Common characters
CharacterEncodingDescription
␣%20Space
"%22Quotation mark
%%25Percent sign
-%2DHyphen-minus
.%2EFull stop or period
<%3CLess-than sign
>%3EGreater-than sign
\%5CBackslash
^%5ECircumflex accent
_%5FUnderscore
`%60Grave accent
{%7BLeft Curly Bracket
|%7CVertical bar
}%7DRight Curly Bracket
~%7ETilde
£%C2%A3Pound sign
€%E2%82%ACEuro sign
## URL-decoding ### URL-decode in Bash ```bash #!/bin/bash URL="%59%69%70%70%65%68%21%20%59%6F%75%72%20%55%52%4C%20%69%73%20%63%68%61%6C%6C%65%6E%67%65%2F%74%72%61%69%6E%69%6E%67%2F%65%6E%63%6F%64%69%6E%67%73%2F%75%72%6C%2F%73%61%77%5F%6C%6F%74%69%6F%6E%2E%70%68%70%3F%70%3D%61%62%67%6D%61%66%65%62%68%6D%62%64%26%63%69%64%3D%35%32%23%70%61%73%73%77%6F%72%64%3D%66%69%62%72%65%5F%6F%70%74%69%63%73%20%56%65%72%79%20%77%65%6C%6C%20%64%6F%6E%65%21" echo $URL | tr -d '%' | xxd -r -p ``` ### URL-decode in Python You can URL-decode in Python with `urllib` and the [unquote function](https://docs.python.org/3/library/urllib.parse.html#urllib.parse.unquote): ```python #!/usr/bin/python from urllib.parse import unquote enc = '%59%69%70%70%65%68%21%20%59%6F%75%72%20%55%52%4C%20%69%73%20%63%68%61%6C%6C%65%6E%67%65%2F%74%72%61%69%6E%69%6E%67%2F%65%6E%63%6F%64%69%6E%67%73%2F%75%72%6C%2F%73%61%77%5F%6C%6F%74%69%6F%6E%2E%70%68%70%3F%70%3D%61%62%67%6D%61%66%65%62%68%6D%62%64%26%63%69%64%3D%35%32%23%70%61%73%73%77%6F%72%64%3D%66%69%62%72%65%5F%6F%70%74%69%63%73%20%56%65%72%79%20%77%65%6C%6C%20%64%6F%6E%65%21' print(unquote(enc)) ``` ## URL-encoding You can URL-encode in Python with `urllib` and the [quote function](https://docs.python.org/3/library/urllib.parse.html#urllib.parse.quote): ```python #!/usr/bin/python from urllib.parse import quote quoted_path = quote('/12d11acb 168887e1/2215f03a b5521a02') print(quoted_path) ``` ## Resorces Percent-encoding - Wikipedia: