Encoding is a set of predefined rules to reversibly transform a piece of information in a certain representation into a completely different representation. The other way round is called decoding.

learn more… | top users | synonyms

-2
votes
1answer
84 views

Turning hex string into readable chars [closed]

I have this blob of hex data which can be found on https://www.reddit.com/r/codes/comments/421xek/can_somebody_help_me_decode_this_blob/ and I am looking to turn it into ...
-1
votes
1answer
52 views

What is this Encoding? [closed]

I would like to know the format of encoding for the text below. Thanks. ...
-5
votes
1answer
38 views

Help to identify this type encoding/encryption? [closed]

What type of encoding/encryption is this? $1$JbzSrvQl$WMLs938aP.EeDn/0dDFQx/
-1
votes
1answer
56 views

Which encryption method is that? [closed]

I have seen it lots of times around the web, but I don't know how it's called. It has a numeric secret key, and the output is composed only by this characters; ".,:;!%&#". I searched all the web ...
1
vote
1answer
141 views

Decoding base64 encoded message with a key [closed]

I am pentesting a database that where I found data which was base64 encoded. I tried the usual method of decoding base64, which didn't work. Later, I found in database a field called ...
9
votes
1answer
22k views

PKCS7 encoding in Java without external libs like BouncyCastle etc

I am working on signing and encoding of CMS/PKCS#7 messages (something similar to C# SignedCms). I have x509certificate from the keystore, rsa private key, ContentInfo. ContentType is "oidPkcs7Data". ...
1
vote
3answers
136 views

The purpose of escaping html entities

By security principles, we are often taught to sanitize input fields for characters such as & or ' so that they cannot be used for SQL injections etc. However, now I have an issue: I really need ...
6
votes
2answers
44 views

Is there an entropy difference between hashing an encoded string?

Of course if I apply (for example) SHA-2 to a base64 encoded string it will give me a different result versus the original data, but from a strength-perspective in terms of entropy, is there a ...
-7
votes
1answer
113 views

Base64 Decoding [closed]

00CDu000000000000000000000000000006e0QW00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001W00000000000000000000000000000000000000000 ...
0
votes
0answers
40 views

CPU instruction encoding on x86 that is free from ROP attacks

x86 has a dense instruction encoding, and thus enables ROP attacks. Are there any CPU instruction encoding schemes that are free from these attacks?
2
votes
2answers
183 views

Is it possible to encode some data in a image and decode the data from hard copy?

I am working on a project which can encode some data in an Image and share it with other people by printing it out as hard copy. Now, other people can take a picture of the hard copy they got and ...
14
votes
3answers
881 views

Why is encryption (or signing) of long lines in E-Mails with PGP problematic?

I am using Thunderbird with Enigmail and OpenPGP to encrypt and/or sign E-Mails. On many occasions Enigmail complains that I have too long lines in the mail and asks how it should wrap them. However ...
2
votes
1answer
81 views

Is HttpUtility.HtmlAttributeEncode considered for single-quotes attributes?

MSDN: The string result from the HtmlAttributeEncode method should be used only for double-quoted attributes. Security issues might arise when using the HtmlAttributeEncode method with ...
2
votes
2answers
122 views

Can an XOR cipher be broken if the plaintext is an incrementing number?

Many moons ago, I was working with a team that was building a public-facing website. We originally built the system using auto-incrementing numeric primary keys as the public identifier for each piece ...
3
votes
1answer
46 views

How common are UTF8 strings in X509

In theory, names in X509 certs are defined as: CHOICE { teletexString TeletexString (SIZE (1..ub-state-name)), printableString PrintableString (SIZE (1..ub-state-name)), universalString ...
1
vote
1answer
76 views

Encode URL in link that will appear on page in plain text?

I need to send a user a link via SMS that when clicked, and then when some demographic info is verified, will allow them to sign up for my service (which is a healthcare portal, so HIPAA/PCI/PII etc). ...
7
votes
2answers
351 views

Odd password scrambling algorithm

I'm researching an application that has password scrambling algorithm that I've not seen before. I generated a few passwords (the max. length allowed is 8 chars), and got the following results: ...
5
votes
5answers
1k views

HTML Entities to hide Email Addresses

I'm on WordPress trying to keep spambots from grabbing email addresses that may be in The Content. WordPress has a nifty little function simply called antispambot() which will convert the email ...
1
vote
2answers
504 views

How was this token decoded?

I've read this interesting comment (about the security level, or lack thereof of some website built by a prominent chip manufacturer, an interesting discussion by it's own virtue, but not my question) ...
45
votes
6answers
9k views

Virus Encoded in Video

So I'm not familiar at all with IT Security, but I'm a bit curious about something. I was watching a TV show and at one point, a virus spreads through an office. They investigate and find out that the ...
1
vote
1answer
162 views

Sketchy traffic from port 3030?

I am running tests on a server that is ran by a close family friend, who agreed to allow me to do so in exchange for the experience I will gather (I am currently a computer science student). On ...
1
vote
1answer
197 views

Possible shellcode mailed to me

When I opened my email this morning I found a rather odd message in my mail box. It didn't seem like your every day spam email as it looked like a base64 encoded string and nothing else. Here is a ...
3
votes
1answer
908 views

What encoding could this be? Looks similar to base64 [closed]

I'm currently doing a pen test and there are these 48 character tokens. I identified the first 22 as base64 encoded values I know. The second part (26 characters) looks base64-ish but it's not. It ...
1
vote
1answer
88 views

All UTF-8 characters for generated passwords

Why do a lot of password generators don't generate strong passwords including chinese, arabian...-characters? All generators I saw, also the included one in my password manager keepass, just output ...
1
vote
2answers
382 views

XSS via REQUEST_URI

Is there any situation where an XSS attack can be performed via the PHP $_SERVER['REQUEST_URI'] variable? For those unfamiliar with it: It contains the complete URL used to access that website, ...
2
votes
1answer
2k views

application/json Content-Type character set

According to the OWASP Application Security Verification Standard: V11.3 Verify that every HTTP response contains a content type header specifying a safe character set (e.g., UTF-8). According ...
3
votes
2answers
284 views

Is there a need to have XSS filters when I'm saving data as XML?

My web-app takes some configs from the user and saves into an XML file (it was not done to stop XSS). The input is XML encoded so that the ",& ... and such characters don't break the XML ...
0
votes
2answers
2k views

Effectively Pentest a Wordpress Site

When it comes to blackbox pentesting of a Wordpress site, the first thing to come to mind is WPScan [http://wpscan.org/]. While pentesting some sites, I faced a common issue i.e it shows that ...
1
vote
0answers
77 views

Is it dangerous to append search query to the base URL?

I'm testing drupal website and I've noticed that search query gets appended to the base URL in the response, like so: query: "hey ho: there" http://www.baseurl.com/search/node/hey ho%3A there query: ...
0
votes
1answer
209 views

What is the encoding of that string? [closed]

I try to find the encoding of a string. I thought at first it was Base64, but actually not, it seems ... Let me explain quickly. For a exercise, I have to decode the following string: ...
0
votes
1answer
357 views

Choosing encoder for payloads in metasploit

I noticed that every payload (for example bind_tcp) in metasploit comes with defaut encoder.( shikata_ga_nai for bind_tcp). Is there a way in metasploit to manualy choose encoding for payloads or way ...
0
votes
1answer
301 views

Is it possible to avoid PHP string validation with malformed UTF-8 string?

Some of the old PHP string functions for example explode() are working with UTF-8 strings, but they don't work properly on malformed UTF-8 strings. Is this a security issue? Is it possible to avoid ...
1
vote
1answer
70 views

What could happen if regex metacharacters using named capturing group are not encoded?

Let's say that a web application take a specific input from the user (e.g., search form), apply a Java regex with named caputring groups on it and use the final output to do other stuff (e.g., look ...
4
votes
3answers
2k views

Security Implications of using Base64 Encoding with Encryption

Are there any security implications of converting a byte-array encryption key into a Base64 string before use? I am creating a generic encryption helper for a project, and for the sake of consistency ...
3
votes
3answers
3k views

How can I bypass double quotes in a attribute based xss attack

The code that I have is: <input type="text" name="some_name" value="<?php echo CHtml::encode($str); ?>" /> $str is the input data. 'CHtml::encode()' is Yii's way of encoding special ...
0
votes
1answer
267 views

How to decode/decrypt strings of text [closed]

So I'm trying to decrypt/decode some text strings. I don't believe they're hashes because they vary in length too much and the software they are used for is able to easily decode them and display them ...
4
votes
2answers
3k views

UTF-7 XSS attacks in modern browsers

I've recently read about utf-7 XSS-attacks (i.e. Ned Batchelders article at http://nedbatchelder.com/blog/200704/xss_with_utf7.html) but could not get any UTF-7 attack to work in modern browsers. (I ...
1
vote
1answer
246 views

Could I XSS a page that filters &,",< and > characters and has Content-Type set to UTF-8?

I am trying to pentest a dummy website that has a form with a TEXTAREA input on one page. When the form is submitted, the contents of the form are displayed on a second page. However, the second page ...
0
votes
1answer
112 views

Can any ECC field element be safely serialized as “compressed” and then restored as uncompressed?

I have a library that stores all its ECC Field Elements in uncompressed form, in a bloated Base64 XML format, and storage has become a concern. (We want to support QR code as a form factor,etc) ...
8
votes
2answers
6k views

Exploiting PHP via GET params

To be clear, this is in the interest of ethical testing to secure an application on behalf of my work. Now that that's out of the way, here are the details: Un-sanitised GET params are used in a ...
7
votes
2answers
1k views

PHP: if charset mismatches (htmlentities UTF-8) viewed by client as ISO-8859-1 (or vice versa)

Short Question: Question: Could any security vulnerabilities arise if a server runs htmlentities as UTF-8 but the client views the results as ISO-8859-1? Assumption: No vulnerabilities exist when ...
1
vote
2answers
142 views

Is storing passwords associated with system processes and binaries in an encoded format acceptable?

When a system must go from a powered down state to a fully operational state without any human intervention it therefore needs access to usable authentication credentials unattended. The system must ...
3
votes
0answers
549 views

XSS in HTML title tag without forward slash

I am trying to find out whether this is vulnerable against XSS: I can control the content of the title tag through the URL. This would make the site vulnerable if it wasn't for the fact that the site ...
0
votes
1answer
361 views

How do I determine the algorithm used on an encrypted string? [duplicate]

I have a Microsoft Access database which contains encrypted data: When I copy-paste it, it looks like $ 8F). How can I determine the used encryption algorithm? How can I convert this to readable ...
2
votes
1answer
4k views

SHA1 hash encoded with base64 results not consistent?

When i take a hash of user input test123+ i get the following base64 result:- YaddchSU52yztwIMdtHzkg3p1oA= The results have been obtained using the online sha1 convertor I m failing to understand how ...
0
votes
1answer
604 views

XSS - Quote Breaking

First of all i don't know if this question already mention here, believe me i search already. so i was trying to break string inside single and double quote of attr below; ...
2
votes
1answer
522 views

.NET provides 8+ ways to encode data to prevent XSS attacks. Which one should I use when? [closed]

I'm looking at ways to use .NET to prevent XSS attacks and have come across the following methods to encode data: string asdf = WebUtility.UrlEncode(code); string asdf1 = ...
0
votes
1answer
212 views

Is it possible to insert data into UUID?

Is it possible to insert arbitrary data into UUID? Let's suppose we have an MD5\SHA hash of something... can we encode that data into a valid UUID?
0
votes
2answers
68 views

Prevention from cross site scripting in different scenerio?

I could not validate malicious characters like ' .< > etc because these characters are required in my application. Also I could not encode characters because user supposed to enter HTML tags in my ...
1
vote
0answers
25 views

Is Webgoat's HTTP Splitting Attack corrupt? [duplicate]

This link describes my problem better: https://code.google.com/p/webgoat/issues/detail?id=42 I was doing the HTTP Splitting exercise in WebGoat. In this exercise, when you send a malformed URL, you ...