0xhexforgeCTF utility layer
hexforge / guides / percent-encoding

GUIDE 11 / WEB

Percent-Encoding in CTF Challenges

Decode the component you are investigating, not the entire URL by reflex. Reserved delimiters can change structure when they become literal characters.

Start with the URL component model

A URL is not one undifferentiated string. Scheme, authority, path, query, and fragment have different delimiters and different reasons for escaping characters. Percent-encoding represents a byte as a percent sign followed by two hexadecimal digits. The escape %2F represents byte 2f, which is the slash character in ASCII. Whether that slash is data or a path separator depends on when and where it is decoded.

Non-ASCII text is normally encoded as UTF-8 first. A single visible character may therefore become several percent escapes. Preserve the exact source value before normalizing uppercase and lowercase hex digits or decoding any layer.

Decode the smallest relevant component

Suppose a challenge provides:

https://lab.invalid/view?note=flag%7Bquery_value%7D&next=%2Fadmin%3Fmode%3Dread

Split the query into fields before decoding values. The note value becomes flag{query_value}. The next value becomes /admin?mode=read. If the whole URL is decoded first, the question mark and equals sign inside next can be mistaken for outer URL structure. Recording key, raw value, decoded value, and operation keeps that ambiguity visible.

Understand the plus-sign exception

HTML form encoding commonly represents a space as +, while ordinary URL parsing can treat a plus as a literal character. JavaScript decodeURIComponent does not convert plus signs to spaces. For form data, replace plus with a space before percent-decoding; for a path or arbitrary URL component, do not. A value such as C%2B%2B+notes illustrates the distinction: the escaped pluses belong to C++, while the unescaped plus may be a form-space.

Recognize nested encoding without decoding blindly

The string %252Fadmin decodes once to %2Fadmin and twice to /admin. That is consistent with double-encoding, but each layer may belong to a different system: a browser, proxy, framework, or application. Record both transitions. In an authorized lab, compare how each component actually interprets the value rather than assuming that two decoding passes occur on the server.

Decoding can change meaning

Never overwrite the captured URL with its decoded display. A security-relevant difference often exists precisely because two components decode at different times.

Common mistakes

Decoding a complete URL as one component

This can expose reserved delimiters and destroy the original boundaries. Parse first, then decode only the field under examination.

Assuming malformed escapes are harmless

A trailing percent sign or non-hex pair should produce an explicit error. Different parsers may reject, preserve, or repair malformed input differently.

Confusing percent-encoding with encryption

The transformation has no key and offers no secrecy. It is a transport representation for bytes in contexts where some characters are reserved or unsafe.

How this guide was verified

The examples were tested with the Hexforge URL tool and independent browser URL APIs. Fixtures covered spaces, literal plus signs, encoded plus signs, Unicode text, encoded query delimiters, malformed escapes, and a two-layer value. Each successful decoded value was re-encoded and compared with the normalized source component.

Compact investigation workflow

  1. Preserve the complete original URL.
  2. Separate path, query, and fragment boundaries.
  3. Record the raw component under investigation.
  4. Determine whether form rules apply.
  5. Decode one layer and inspect structure.
  6. Continue only when another encoded layer is supported by evidence.
  7. Record how the target system interprets the value.