Encoding is a set of predefined rules to reversibly transform a piece of information in a certain representation into a completely different representation. The other way round is called decoding.

learn more… | top users | synonyms

7
votes
2answers
257 views

Odd password scrambling algorithm

I'm researching an application that has password scrambling algorithm that I've not seen before. I generated a few passwords (the max. length allowed is 8 chars), and got the following results: ...
2
votes
1answer
20 views

How common are UTF8 strings in X509

In theory, names in X509 certs are defined as: CHOICE { teletexString TeletexString (SIZE (1..ub-state-name)), printableString PrintableString (SIZE (1..ub-state-name)), universalString ...
1
vote
1answer
64 views

Sketchy traffic from port 3030?

I am running tests on a server that is ran by a close family friend, who agreed to allow me to do so in exchange for the experience I will gather (I am currently a computer science student). On ...
1
vote
1answer
161 views

Possible shellcode mailed to me

When I opened my email this morning I found a rather odd message in my mail box. It didn't seem like your every day spam email as it looked like a base64 encoded string and nothing else. Here is a ...
3
votes
1answer
198 views

What encoding could this be? Looks similar to base64 [closed]

I'm currently doing a pen test and there are these 48 character tokens. I identified the first 22 as base64 encoded values I know. The second part (26 characters) looks base64-ish but it's not. It ...
1
vote
1answer
70 views

All UTF-8 characters for generated passwords

Why do a lot of password generators don't generate strong passwords including chinese, arabian...-characters? All generators I saw, also the included one in my password manager keepass, just output ...
1
vote
2answers
155 views

XSS via REQUEST_URI

Is there any situation where an XSS attack can be performed via the PHP $_SERVER['REQUEST_URI'] variable? For those unfamiliar with it: It contains the complete URL used to access that website, ...
2
votes
1answer
581 views

application/json Content-Type character set

According to the OWASP Application Security Verification Standard: V11.3 Verify that every HTTP response contains a content type header specifying a safe character set (e.g., UTF-8). According ...
1
vote
0answers
61 views

Is it dangerous to append search query to the base URL?

I'm testing drupal website and I've noticed that search query gets appended to the base URL in the response, like so: query: "hey ho: there" http://www.baseurl.com/search/node/hey ho%3A there query: ...
0
votes
1answer
112 views

What is the encoding of that string? [closed]

I try to find the encoding of a string. I thought at first it was Base64, but actually not, it seems ... Let me explain quickly. For a exercise, I have to decode the following string: ...
0
votes
1answer
123 views

Choosing encoder for payloads in metasploit

I noticed that every payload (for example bind_tcp) in metasploit comes with defaut encoder.( shikata_ga_nai for bind_tcp). Is there a way in metasploit to manualy choose encoding for payloads or way ...
0
votes
0answers
283 views

Can everyone find the pictures one sends over whatsapp?

I was trying out a whatsapp compatible chat application on my laptop. Someone sent me a picture and I received a link to that picture on the whatsapp server. Everyone who visits the link can see the ...
1
vote
1answer
64 views

What could happen if regex metacharacters using named capturing group are not encoded?

Let's say that a web application take a specific input from the user (e.g., search form), apply a Java regex with named caputring groups on it and use the final output to do other stuff (e.g., look ...
4
votes
3answers
1k views

Security Implications of using Base64 Encoding with Encryption

Are there any security implications of converting a byte-array encryption key into a Base64 string before use? I am creating a generic encryption helper for a project, and for the sake of consistency ...
0
votes
1answer
156 views

How to decode/decrypt strings of text [closed]

So I'm trying to decrypt/decode some text strings. I don't believe they're hashes because they vary in length too much and the software they are used for is able to easily decode them and display them ...
2
votes
3answers
1k views

How can I bypass double quotes in a attribute based xss attack

The code that I have is: <input type="text" name="some_name" value="<?php echo CHtml::encode($str); ?>" /> $str is the input data. 'CHtml::encode()' is Yii's way of encoding special ...
1
vote
1answer
177 views

Could I XSS a page that filters &,",< and > characters and has Content-Type set to UTF-8?

I am trying to pentest a dummy website that has a form with a TEXTAREA input on one page. When the form is submitted, the contents of the form are displayed on a second page. However, the second page ...
3
votes
2answers
261 views

Is there a need to have XSS filters when I'm saving data as XML?

My web-app takes some configs from the user and saves into an XML file (it was not done to stop XSS). The input is XML encoded so that the ",& ... and such characters don't break the XML ...
0
votes
1answer
64 views

Can any ECC field element be safely serialized as “compressed” and then restored as uncompressed?

I have a library that stores all its ECC Field Elements in uncompressed form, in a bloated Base64 XML format, and storage has become a concern. (We want to support QR code as a form factor,etc) ...
4
votes
5answers
847 views

HTML Entities to hide Email Addresses

I'm on WordPress trying to keep spambots from grabbing email addresses that may be in The Content. WordPress has a nifty little function simply called antispambot() which will convert the email ...
1
vote
2answers
107 views

Is storing passwords associated with system processes and binaries in an encoded format acceptable?

When a system must go from a powered down state to a fully operational state without any human intervention it therefore needs access to usable authentication credentials unattended. The system must ...
0
votes
1answer
223 views

Is it possible to avoid PHP string validation with malformed UTF-8 string?

Some of the old PHP string functions for example explode() are working with UTF-8 strings, but they don't work properly on malformed UTF-8 strings. Is this a security issue? Is it possible to avoid ...
2
votes
0answers
367 views

XSS in HTML title tag without forward slash

I am trying to find out whether this is vulnerable against XSS: I can control the content of the title tag through the URL. This would make the site vulnerable if it wasn't for the fact that the site ...
0
votes
1answer
202 views

How do I determine the algorithm used on an encrypted string? [duplicate]

I have a Microsoft Access database which contains encrypted data: When I copy-paste it, it looks like $ 8F). How can I determine the used encryption algorithm? How can I convert this to readable ...
0
votes
2answers
1k views

Effectively Pentest a Wordpress Site

When it comes to blackbox pentesting of a Wordpress site, the first thing to come to mind is WPScan [http://wpscan.org/]. While pentesting some sites, I faced a common issue i.e it shows that ...
0
votes
1answer
482 views

XSS - Quote Breaking

First of all i don't know if this question already mention here, believe me i search already. so i was trying to break string inside single and double quote of attr below; ...
2
votes
1answer
323 views

.NET provides 8+ ways to encode data to prevent XSS attacks. Which one should I use when? [closed]

I'm looking at ways to use .NET to prevent XSS attacks and have come across the following methods to encode data: string asdf = WebUtility.UrlEncode(code); string asdf1 = ...
7
votes
2answers
1k views

PHP: if charset mismatches (htmlentities UTF-8) viewed by client as ISO-8859-1 (or vice versa)

Short Question: Question: Could any security vulnerabilities arise if a server runs htmlentities as UTF-8 but the client views the results as ISO-8859-1? Assumption: No vulnerabilities exist when ...
0
votes
1answer
173 views

Is it possible to insert data into UUID?

Is it possible to insert arbitrary data into UUID? Let's suppose we have an MD5\SHA hash of something... can we encode that data into a valid UUID?
0
votes
2answers
63 views

Prevention from cross site scripting in different scenerio?

I could not validate malicious characters like ' .< > etc because these characters are required in my application. Also I could not encode characters because user supposed to enter HTML tags in my ...
4
votes
2answers
2k views

UTF-7 XSS attacks in modern browsers

I've recently read about utf-7 XSS-attacks (i.e. Ned Batchelders article at http://nedbatchelder.com/blog/200704/xss_with_utf7.html) but could not get any UTF-7 attack to work in modern browsers. (I ...
1
vote
0answers
22 views

Is Webgoat's HTTP Splitting Attack corrupt? [duplicate]

This link describes my problem better: https://code.google.com/p/webgoat/issues/detail?id=42 I was doing the HTTP Splitting exercise in WebGoat. In this exercise, when you send a malformed URL, you ...
1
vote
3answers
272 views

Are Modern Servers susceptible to HTTP Splitting Attacks

Note: I know how HTTP Splitting works. Note 2: I am not working in WebGoat. I am trying to make this on my own. I am trying to imitate the HTTP Splitting attack on my machine. For that I wrote this ...
3
votes
3answers
281 views

Can a mismatched server encoding on HTTP POST or GET result in a security issue?

It is possible for a server to parse HTTP POST and GET data with a fixed encoding or one that is dynamic with the client's response. Consider the situation where a client uses UTF7,32 or any other ...
0
votes
1answer
581 views

XSS: What type of text encoding is this? [closed]

I found this encoding as a XSS example to bypass certain filters. Been trying to look some information (plus encoder/decoder tool) about this type of encoding but was pretty difficult without knowing ...
3
votes
1answer
617 views

Why does broad based malware use XOR obfuscation?

As per title... The malware can easily be de-obfuscated if it was obfuscated using common and known XOR techniques. Why don't malware authors use any other method that make it much harder to ...
4
votes
2answers
627 views

Unknown Asian/Chinese registry keys

On a Windows Server 2008 machine found registry key "潓瑦慷敲卜湹潣敶祲" under HKEY_CURRENT_USER of the administrator account. It contains a value "敓癲捩剥湵楮杮" of type REG_DWORD which is set to 0. I scanned the ...
8
votes
2answers
4k views

Exploiting PHP via GET params

To be clear, this is in the interest of ethical testing to secure an application on behalf of my work. Now that that's out of the way, here are the details: Un-sanitised GET params are used in a ...
3
votes
2answers
85 views

SPAM postscript

I have been getting a lot of SPAM lately that have some type of encoded block added to the end. I am wondering if anyone here would know how to decode it. Here is an example: ...
1
vote
2answers
413 views

How was this token decoded?

I've read this interesting comment (about the security level, or lack thereof of some website built by a prominent chip manufacturer, an interesting discussion by it's own virtue, but not my question) ...
6
votes
1answer
937 views

Reducing password length with hash function

Suppose I would like to use a very long string as a password. As an example we can just say this string is 100 characters in length. However, suppose the application for which I would like to use ...
4
votes
2answers
6k views

HTML encoding to protect against XSS

While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
16
votes
4answers
5k views

Is $_SERVER[ ] a safe source of data in PHP?

Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]? Thanks. OVERVIEW OF RESPONSES: So it seems there is a consensus that some ...
1
vote
1answer
229 views

Understanding nibbles & encoding using owasp EnDe tool?

I'm using owasp EnDe web-based tool to understand nibbles and encoding in general. This online utility in my knowledge is the best free resource avaiable for anyone who is interested to learn encoding ...
3
votes
2answers
231 views

Why some antiviruses detect viruses and some not?

I am curious why some anti-viruses detect viruses and some do not. From what I found online, antiviruses parse the binary files and check the sequence of code which is malicious(exists in virus ...
1
vote
2answers
623 views

Breaking out of attribute in double quotes

I have a piece of code that allows for [url]someurl[/url] BB-Code and replaces it with <a href="someurl">someurl</a> It takes two precautions to prevent XSS. It replaces ...
14
votes
3answers
5k views

How do I prevent this type of SQL injection attack?

Our company has been using several tool (Veracode, Appscan, etc) to verify that our applications meet minimum security requirements. I have inherited a legacy application which has several flaws. I've ...
2
votes
1answer
160 views

Encoding HTML email content

Say I have a form on my website. The input elements of the form are: email address, name and some feedback textarea. The server-side application that this form is submitted to will send an HTML ...
-3
votes
1answer
281 views

What Type Of Encoding Is This? [closed]

I need help, what type of encoding is this? It is a popular encoding, not an encryption. begin 666 Restricted.zip M4$L#!!0````(`%T[="_]<LYX`P(``'0#```.````4F5S=')I8W1E9"YT>'1M ...
2
votes
1answer
3k views

SHA1 hash encoded with base64 results not consistent?

When i take a hash of user input test123+ i get the following base64 result:- YaddchSU52yztwIMdtHzkg3p1oA= The results have been obtained using the online sha1 convertor I m failing to understand how ...