# bro signature http-request double encoded cause FN ?

**URL:** <https://community.zeek.org/t/bro-signature-http-request-double-encoded-cause-fn/2406>\
**Category:** Zeek\
**Created:** [August 16, 2012, 10:42pm UTC](https://community.zeek.org/t/bro-signature-http-request-double-encoded-cause-fn/2406 "2012-08-16T22:42:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rmkml2](https://avatars.discourse-cdn.com/v4/letter/r/b487fb/32.png) [@rmkml2](https://community.zeek.org/u/rmkml2)\
**Post date:** [August 16, 2012, 10:42pm UTC](https://community.zeek.org/t/bro-signature-http-request-double-encoded-cause-fn/2406/1 "2012-08-16T22:42:42Z")

</div>

Hi,  
ok it's long time I don't worked on bro signature "language",  
but Im back today and Im start few tests:

0) web test without encoding : /abc  
OK, detected by http-request /.\*\/abc.\*/

1) http utf8 simple encoded like /ab%63  
OK, detected by http-request /.\*\/abc.\*/

2) http utf8 double encoded like /ab%2563  
NOT detected by http-request /.\*\/abc.\*/

Anyone confirm this ?  
Maybe need switch a variable, where ?

Regards  
Rmkml

[http://twitter.com/rmkml](http://twitter.com/rmkml)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/bro-signature-http-request-double-encoded-cause-fn/2406/2 "2022-05-06T15:40:30Z")

</div>