I am pentesting a web application. It makes a backend call to another application, and I am trying to hijack that call.
I have gained control over the URL path, query parameters, and fragment that is being sent (e.g. if the URL is https://internal-app.com/
I can make it https://internal-app.com/whatever-path-I-want?also=queryparameters#andthefragment
). But one of the query parameters is added automatically by the application, no matter what I do, and I'm trying to strip that query parameter.
I've discovered that the internal application interprets each byte of a unicode character as its own character (for example, with Ē
, U+0112
, which has a hex representation in UTF-8
of C4 92
, the application interprets each byte separately, and C4 92
becomes Ä’
, despite the fact that Ē
was sent). I'm trying to exploit this bug to send the fragment symbol, #
, without the first application realizing it (because if it realizes it, it adds the query parameter before the fragment).
So I need a unicode character with at least one hex byte of 23 (#=U+0023
). But this seems to be impossible, as according to the Wikipedia page for UTF-8, in all characters that have multiple bytes, the bytes start with 10 (and the binary for #
is 00100011
).
Am I right in thinking that this is impossible? And if so, should I try a different encoding for the URL, or is there another character that I could try exploiting? (I've already tried the null byte, it rejects all requests with a null byte for security reasons.)