Why does the URL http://a/%%30%30 crash Google Chrome?

Tom Scott explains this in his YouTube video:

  1. http://a/%%30%30 is decoded as http://a/%00 because %30 is 0
  2. http://a/%00 is then further decoded by another piece of code as http://a/<NULL> because %00 is the NULL character

The bug was originally demonstrated by Andris Atteka who simply added a null character to the string.

Related Posts:

  1. When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site? [closed]
  2. When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site? [closed]
  3. When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site?
  4. Error `sec_error_revoked_certificate` when viewed in Firefox only
  5. How do I authenticate WP users from a chrome extension?
  6. What’s the best approach for generating a new API key?
  7. Simplest two-way encryption using PHP
  8. what is a auth_user_file.txt?
  9. Is moving wp-config outside the web root really beneficial?
  10. Best way to eliminate xmlrpc.php?
  11. What’s the easiest way to stop WP from ever logging me out
  12. If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?
  13. Prevent access or auto-delete readme.html, license.txt, wp-config-sample.php
  14. What’s the difference between esc_* functions?
  15. How to set up fail2ban with WordFence?
  16. Which KSES should be used and when?
  17. How to remove “Connection Information” requirement on localhost install of WP on MACOSX
  18. Disable comment windows for all existing posts (pages/blogposts)
  19. WordPress “Site Health Status” trust it or myself for its security advice?
  20. Generate WordPress salt
  21. Stop wordpress automatically escaping $_POST data
  22. Is WP vulnerable when updating plugins or themes?
  23. how can i embed wordpress backend in iframe
  24. Garbage in beginning of wp-config.php – was this WP installation compromised?
  25. Handling nonces for actions from guests to logged-in users
  26. Can I force a password change?
  27. What is the relationship between cURL, WordPress and cacert.pem?
  28. Is it necessary to use esc_url with template tags such as get_permalink?
  29. What is pclzip.lib.php file that wordfence think it’s a malicious code
  30. How to prevent bot or someone to modify any file automatically?
  31. How to disable XML-RPC from Linux command-line in a total way?
  32. HTTP Security Headers in wp-config
  33. How to remove javascript malware in wordpress site [closed]
  34. Staging Site: Made Public – Security Questions
  35. Best Way to Enable Two Step Authentication
  36. Securing my WordPress Files and Directories
  37. Single sign-on: wp_authenticate_user vs wp_authenticate
  38. How to allow internal links using wp_kses filtration
  39. Securing a multi-user permission structure
  40. How does Cross Site Scripting (XSS) work exactly? [closed]
  41. Is default functions like update_post_meta safe to use user inputs?
  42. No option “I would like my site to be private, visible only to users I choose” in Privacy Settings
  43. How does the “authentication unique keys and salts” feature work?
  44. vs WordPress Security
  45. esc_html__ security : what for in this example?
  46. Securing wp-config leads to sensitive information leak on wp-settings
  47. Suspicious Files
  48. What’s the point of forbidding access to wp-config.php?
  49. wp-json and what data does it give away?
  50. Is is necessary to use security plugin for wordpress? [closed]
  51. neccessary?
  52. wp-config.php being written by attacker
  53. XML-RPC errors they know my username?
  54. Is [admin / admin] acceptable for all local websites?
  55. Simple Online Payment for Event Registration [closed]
  56. Client side HTTP parameter pollution (reflected)
  57. Local file inclusion critical security issue [closed]
  58. my wordpress website is suspended [closed]
  59. Malware script in database post table only? [closed]
  60. Best practices to assert current_user_can() with guests
  61. XMLRPC slow and weird websites/services
  62. iTheme Security always lockout my account [closed]
  63. Is it sensible to worry about sanitizing admin input in plugin custom CSS?
  64. WordPress Front end Form – Enable to Submit PHP Codes
  65. Is it safe to hand over the admin rights?
  66. Is it safe use wp_editor in public contact form
  67. Is WordPress MultiSite secure & how much can it scale? [closed]
  68. How safe is current_user_can()?
  69. Is it safe to give wordpress directories ownership to www-data?
  70. How can I force a specific password?
  71. Do we need to escape data that we receive from theme options?
  72. Why does WordPress change a file’s permissions?
  73. Side effects of disallowing *.php requests in production environment?
  74. Outgoing new connection to linked Websites – why?
  75. My Site keeps crashing due to the wp-confg file being deleted
  76. Someone keeps changing my SITEURL (mysql injection or xss?) [closed]
  77. Who updates the wp-admin/core file?
  78. Replace domain in database
  79. Does this code indicate an exploit?
  80. What highest security brake with wordpress and static files?
  81. Spam in WordPress root folder
  82. Has anyone developed a anti-spam plugin to simply allow users to BLOCK whatever they wish to, but one that will also go easy on IP addresses?
  83. how to protect wordpress content from crawler
  84. Can WordPress admin user + database credentials be used to gain Cpanel or FTP access?
  85. Should I worry about SQL injection when using REST API?
  86. Links to root domain from search engines don’t work, but direct links and links from other referrers do
  87. How can I backup my site if it gets hacked?
  88. Cannot access wp admin of WordPress website (security plugin issue) [closed]
  89. Why are the latest visits to my website originating from my own website?
  90. How do I hide WordPress users from security scanning?
  91. Background Updates Not Happening
  92. wp-config.php file and code injection
  93. FORCE_SSL_ADMIN affecting subdomains
  94. What is the best security $_POST method?
  95. Is WordPress ready for GDPR compliance? [closed]
  96. Should WordPress Add Options to Enhance Security or Leave it to plugin developers? [closed]
  97. Move data from wp-config to another file
  98. Heartbleed: What is it and what are options to mitigate it?
  99. OpenVPN vs. IPsec – Pros and cons, what to use?
  100. How to test if my server is vulnerable to the ShellShock bug?

Leave a Comment