Using /% you can generate an error on many servers, and when they have not bothered to hide information it can be revealing.

Notices where this attachment appears

1. Embed this notice
   she hacked you (ekis@mastodon.social)'s status on Wednesday, 18-Dec-2024 16:53:17 JST she hacked you

   Don't have time for a banner grab but still interested in basic info about a server?

   Well taking advantage of a server's inability to process '%' b/c it expects two hex digits to follow; in many cases it errors

   Preventing this from happening is actually easy

   It requires an essential secure programming principle: verify, validate, and sanitize your input

   This principle should be applied to EVERY input, and yes the URL is input

   #infosec #security #it #sysadmin #tech #development #programming