Editing Shellcode (section)

===Percent encoding===
Exploits that target browsers commonly encode shellcode in a JavaScript string using [[percent-encoding]], escape sequence encoding "{{mono|\uXXXX}}" or [[Character encodings in HTML|entity encoding]].<ref>{{cite web |url=http://www.iss.net/security_center/reference/vuln/JavaScript_Large_Unescape.htm |title=JavaScript large number of unescape patterns detected |archive-url=https://web.archive.org/web/20150403203325/http://www.iss.net/security_center/reference/vuln/JavaScript_Large_Unescape.htm |archive-date=2015-04-03 |url-status=dead}}</ref> Some exploits also obfuscate the encoded shellcode string further to prevent detection by [[intrusion detection|IDS]].

For example, on the [[IA-32]] architecture, here's how two <code>[[NOP (code)|NOP]]</code> (no-operation) instructions would look, first unencoded:
 90             NOP
 90             NOP

{|class=wikitable
|+ Encoded double-NOPs:
|-
! scope=row | percent-encoding
| {{code|unescape("%u9090")}}
|-
! scope=row | unicode literal
| {{code|"\u9090"}}
|-
! scope=row | HTML/XML entity
| {{code|"&#x9090;"}} or {{code|"&#37008;"}}
|}

This instruction is used in [[NOP slide]]s.