urlenc is a small and pretty fast commandline utility to URL-encode or -decode selected datastreams.
While common tools like urlencode(1)
exist, urlenc provides extended functionality to double-, triple- or N-encode
streams. Furthermore, the region mode enables isolated encoding of predefined
regions. Both of these features may be of use when you want to process a large
list of URLs containing payloads.
urlenc does not adhere to RFC3986 and,
thus, encodes arbitrary bytes. Because why not?
You can install urlenc via go get:
$ go get -u github.com/rhelmke/urlencBut don't forget to put your go installation path (usually $HOME/go/bin) into
your $PATH!
Another option would be to download a prebuilt package from the Releases-tab of this repository.
Usage: urlenc [flags] [input_file]
--bufsize int I/O buffer size (default 1024)
-d, --decode Decode input
--keepdelim Don't remove delims
--ldelim string Lefthand region delimiter (default ";;;")
-l, --line Newline passthrough
-o, --output string Output file (default: stdout)
--rdelim string Righthand region delimiter (default ";;;")
--region Encode or decode data within a
predefined region that is defined
by a lefthand (--ldelim) and
righthand (--rdelim) boundary
-r, --rounds int Encode/decode 'r' times (default 1)
--version Print version
-h, --help Print usage
input_file optional (default: stdout)
In its default behavior, urlenc takes an input data stream from stdin and
writes each byte to stdout. If you want to alter this behavior, specify an
input_file or set an output file via the -o flag.
When setting the -l flag, urlenc does not encode newline characters:
-r flag can be used to specify the rounds a given byte will be encoded.
This can be used to, e.g., double-encode data:
-d flag:
Imagine you have a large list of URLs. Maybe there is a set of query parameters you want to test for common vulnerabilities? But some of these characters need encoding to be properly handled by the webserver. This is where regions come into play.
By setting the --region flag, you can explicitly tell urlenc which parts of
a datastream should be encoded or decoded. The boundaries of a region are
defined by two strings that represent its beginning (--ldelim) and end
(--rdelim). You can define as many regions as you want within your input data
stream. Suppose your payloads.txt looks like this:
http://example.net/search?q=<script>alert(123);</script>
http://example.net/search?q=<ScRipT>alert("XSS");</ScRipT>
http://example.net/search?q=<script>alert(123)</script>
http://example.net/search?q=<script>alert("hellox worldss");</script>
http://example.net/search?q=<script>alert(“XSS”)</script>
http://example.net/search?q=<script>alert(“XSS”);</script>
http://example.net/search?q=<script>alert(‘XSS’)</script>
http://example.net/search?q=“><script>alert(“XSS”)</script>
http://example.net/search?q=<script>alert(/XSS”)</script>
http://example.net/search?q=<script>alert(/XSS/)</script>
Then you can insert a lefthand delimter, e.g. ^START^, and a righthand delimiter,
e.g. ^STOP^ like this:
http://example.net/search?q=^START^<script>alert(123);</script>^STOP^
http://example.net/search?q=^START^<ScRipT>alert("XSS");</ScRipT>^STOP^
http://example.net/search?q=^START^<script>alert(123)</script>^STOP^
http://example.net/search?q=^START^<script>alert("hellox worldss");</script>^STOP^
http://example.net/search?q=^START^<script>alert(“XSS”)</script>^STOP^
http://example.net/search?q=^START^<script>alert(“XSS”);</script>^STOP^
http://example.net/search?q=^START^<script>alert(‘XSS’)</script>^STOP^
http://example.net/search?q=^START^“><script>alert(“XSS”)</script>^STOP^
http://example.net/search?q=^START^<script>alert(/XSS”)</script>^STOP^
http://example.net/search?q=^START^<script>alert(/XSS/)</script>^STOP^
Finally, pipe it to urlenc:
Oh, by the way. Since urlenc is entirely written in go, it supports UTF-8:
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent