Purpose: Modifying and sending custom HTTP requests requires encoding/decoding to ensure proper server interaction, prevent errors, and allow you to examine or manipulate web application data.

URL Encoding

URL encoding is essential for ensuring request data and headers are correctly parsed by the server. Failing to encode special characters often results in server errors.

Key Characters to Encode:

• Spaces: Unencoded spaces may indicate the premature end of request data.
• Ampersand (&): Otherwise interpreted by the server as a parameter delimiter.
• Hash (#): Otherwise interpreted as a fragment identifier.

Tool Specifics:

• Burp Suite: Select text > Right-click > Convert Selection > URL > URL-encode (or use shortcut CTRL+U). You can also enable an option to auto-encode as you type.
• OWASP ZAP: Automatically URL-encodes request data in the background (explicit manual action is usually not required).
• Advanced URL Types: Full URL-Encoding and Unicode URL encoding are also useful for payloads with many special characters.

Decoding & Alternative Encodings

Web applications frequently encode data, and backend servers often expect specific formats. You must be able to decode to read the data, and encode to interact with the backend.

Common Supported Formats:

• HTML
• Unicode
• Base64
• ASCII hex

Tool Specifics:

• Burp Suite: Access the Decoder tab or use the Burp Inspector (found in the Proxy or Repeater tabs). Burp allows you to quickly chain encodings by selecting a new method directly in the output pane.