URL encoding issue

KingRules's Avatar


04 Sep, 2017 02:33 PM


My web application is performing a post request with encoded timestamp field with time zone offset, when this request is passed through Arachni scanner proxy, the special chars in the URL are decoded by Arachni somehow incorrectly(not sure if this is correct). do this server is giving 500 server error.

URL: https://my-page.web.com/submit? saveTime=2017-08-31T17%3A47%3A24%2B01%3A00
Changed URL at proxy: https://my-page.web.com/submit? saveTime=2017-08-31T17:47:24%2001:00

can you please help how i can overcome this ? is there any settings ?

  1. 1 Posted by KingRules on 04 Sep, 2017 02:37 PM

    KingRules's Avatar

    problem i could see B which is part of %2B is getting decoded as 20 not the entire %2B word

  2. Support Staff 2 Posted by Tasos Laskos on 06 Sep, 2017 03:17 PM

    Tasos Laskos's Avatar

    Actually, what's happening is that %2B is decoded to +, but + is also decoded which basically turns it into %20 since they both mean space.

    There seems to be an issue with the URL normalization process, I'll look into it and let you know.


  3. 3 Posted by KingRules on 06 Sep, 2017 03:28 PM

    KingRules's Avatar

    thanks @Tasos Laskos , will wait for the response

  4. Support Staff 4 Posted by Tasos Laskos on 07 Sep, 2017 03:32 PM

    Tasos Laskos's Avatar

    I think I fixed it properly, running some tests now to verify.

  5. 5 Posted by KingRules on 08 Sep, 2017 01:46 PM

    KingRules's Avatar

    superb, thanks for looking into this quickly

  6. Support Staff 6 Posted by Tasos Laskos on 09 Sep, 2017 02:49 PM

    Tasos Laskos's Avatar

    Nightlies are up, give them a shot please.

  7. 7 Posted by KingRules on 11 Sep, 2017 10:12 AM

    KingRules's Avatar

    thanks tested with arachni-2.0dev-1.0dev-linux-x86_64.tar.gz 08-Sep-2017 10:58 179M Linux archive for x86 64bit architectures.
    it seems to be working.
    can you please tell me when will the formal release planned ?

  8. Support Staff 8 Posted by Tasos Laskos on 12 Sep, 2017 04:23 PM

    Tasos Laskos's Avatar

    I'm sorry I don't have a timetable for that yet.

  9. 9 Posted by KingRules on 12 Sep, 2017 04:24 PM

    KingRules's Avatar

    thats fine, thanks anyways for looking into it

  10. Support Staff 10 Posted by Tasos Laskos on 12 Sep, 2017 04:31 PM

    Tasos Laskos's Avatar

    No worries.

  11. Tasos Laskos closed this discussion on 12 Sep, 2017 04:31 PM.

Comments are currently closed for this discussion. You can start a new one.

Keyboard shortcuts


? Show this help
ESC Blurs the current field

Comment Form

r Focus the comment reply box
^ + ↩ Submit the comment

You can use Command ⌘ instead of Control ^ on Mac