{"id":26270547,"url":"https://github.com/ndr-repo/awesome-encoding-escaping","last_synced_at":"2026-05-07T23:10:03.165Z","repository":{"id":281745276,"uuid":"946286511","full_name":"ndr-repo/awesome-encoding-escaping","owner":"ndr-repo","description":"A repository for tools and documentation for learning string encoding \u0026 unicode escaping.","archived":false,"fork":false,"pushed_at":"2025-03-10T23:04:37.000Z","size":0,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-03-10T23:32:11.350Z","etag":null,"topics":["awesome-list","cybersecurity","encoding","ethical-hacking","javascript","obfuscation","pentesting","php","waf-bypass","xss"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ndr-repo.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2025-03-10T22:50:42.000Z","updated_at":"2025-03-10T23:04:40.000Z","dependencies_parsed_at":"2025-03-10T23:32:16.069Z","dependency_job_id":null,"html_url":"https://github.com/ndr-repo/awesome-encoding-escaping","commit_stats":null,"previous_names":["ndr-repo/awesome-encoding-escaping"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ndr-repo%2Fawesome-encoding-escaping","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ndr-repo%2Fawesome-encoding-escaping/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ndr-repo%2Fawesome-encoding-escaping/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ndr-repo%2Fawesome-encoding-escaping/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ndr-repo","download_url":"https://codeload.github.com/ndr-repo/awesome-encoding-escaping/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243532556,"owners_count":20306157,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["awesome-list","cybersecurity","encoding","ethical-hacking","javascript","obfuscation","pentesting","php","waf-bypass","xss"],"created_at":"2025-03-14T06:16:18.175Z","updated_at":"2026-05-07T23:10:03.160Z","avatar_url":"https://github.com/ndr-repo.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# awesome-encoding-escaping\n\nA repository for tools and documentation for learning string encoding \u0026 unicode escaping. An effective obfuscation method for writing offensive security testing payloads for web applications. \n\nCommonly used with programming languages like JavaScript, PHP, \u0026 HTML for WAF bypass. Encoding can also assist in your success as a red team operator when attempting to bypass file upload restrictions.\n\n## Encoding methods \u0026 examples\n\n### HTML/URL Encoding\n\n- The most basic and common form of encoding, in my opinion. You can find this used for URLs in your browser.\n\n  ASCII to HTML-encoded:\n```\n        ASCII - /\n```\n```    \n        HTML encoded - %2F\n```\n  Common pentesting use case - File path traversal:\n ```\n        ASCII - ../../\n  ```\n\n  ``` \n        HTML encoded - %2E%2E%2F%2E%2E%2F\n   ```\nFor more on file path traversal, see [PortSwigger - File Path Traversal](https://portswigger.net/web-security/file-path-traversal).\n\n### Unicode Escaping \n\nASCII to HTML-encoded:\n\n```\n        ASCII - /\n```\n\n```    \n        Unicode escaped - \\u002F\n```\n\nCommon pentesting use case - XSS:\n\n```\n   ASCII - alert(document.cookie);\n```\n```\n   Unicode escaped - alert\\u0028document\\u002Ecookie\\u0029;\n```\n### Base64 Encoding\n\nRed team use case:\n\nObfuscation of payloads for server-side RCE and post-exploitation frameworks\n\n## Resources\n\n### Tools\n\n[CyberChef](https://gchq.github.io/CyberChef/) - A versatile web application used to obfuscate or deobfuscate strings. Can be ran offline and used for other scenarios as well. Includes various code beautifiers, decoders, and unescaping tools.\n\n[Obsidian Forensics - Unfurl](https://github.com/obsidianforensics/unfurl) - One of my favorite open-source tools of all time. Unfurl is a CLI and GUI tool used to decode URLs and other string inputs. Open-souce and free to install locally. Try it online at [https://dfir.blog/unfurl](https://dfir.blog/unfurl).\n\n[Dencode](https://dencode.com/en/string) - An online string encoder/decoder. Quickly visualize various methods of encoding and unicode escaping inside the tool for a high-level overview.\n\n[Dencode - Unicode Escape](https://dencode.com/en/string/unicode-escape) - An online unicode escaping tool, quickly visualize escaped string for character memorization or payload use.\n\n[Google Admin Toolbox - Encode/Decode](https://toolbox.googleapps.com/apps/encode_decode/) - Offers encoding and decoding for SAML, as well as a few code beautifiers. \n\n### Documentation\n\n[W3Schools - HTML URL Encoding Reference](https://www.w3schools.com/tags/ref_urlencode.ASP) - A reference for standard HTML URL encoding and their cooresponding ASCII character values.\n\n[HTML URL Encoding - GeeksforGeeks](https://www.geeksforgeeks.org/html-url-encoding/) - An alternate reference for HRML URL encoding\n\n[OWASP XSS Filter Evasion Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html) - Contains working examples of encoded and escaped JavaScript payloads.\n\n[RFC 5137 - ASCII Escaping of Unicode Characters](https://www.rfc-editor.org/rfc/rfc5137)\n\n[PortSwigger - XSS Cheat Sheet](https://portswigger.net/web-security/cross-site-scripting/cheat-sheet) - Not directly encoding related, often need a bit of encoding or escaping for production use in the modern-day.\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fndr-repo%2Fawesome-encoding-escaping","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fndr-repo%2Fawesome-encoding-escaping","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fndr-repo%2Fawesome-encoding-escaping/lists"}