Encoding is a set of predefined rules to reversibly transform a piece of information in a certain representation into a completely different representation. The other way round is called decoding.

learn more… | top users | synonyms

7
votes
2answers
257 views

Odd password scrambling algorithm

I'm researching an application that has password scrambling algorithm that I've not seen before. I generated a few passwords (the max. length allowed is 8 chars), and got the following results: ...
-4
votes
1answer
99 views

What encryption is used in this email? [closed]

bobnick1998sw@yopmail.com 96Xx7Tfrf+2zLvKiSXLAoY+W4dh6h+r4ML3JlmXrkyQ= bobnick1998sw1@gmail.com 888IK6Jz5tLP11RcEfWB/CcSbq4x7FIX2BtRi15o7dc= Here are the emails and the encrypted emails, now can ...
4
votes
5answers
847 views

HTML Entities to hide Email Addresses

I'm on WordPress trying to keep spambots from grabbing email addresses that may be in The Content. WordPress has a nifty little function simply called antispambot() which will convert the email ...
1
vote
2answers
412 views

How was this token decoded?

I've read this interesting comment (about the security level, or lack thereof of some website built by a prominent chip manufacturer, an interesting discussion by it's own virtue, but not my question) ...
2
votes
1answer
20 views

How common are UTF8 strings in X509

In theory, names in X509 certs are defined as: CHOICE { teletexString TeletexString (SIZE (1..ub-state-name)), printableString PrintableString (SIZE (1..ub-state-name)), universalString ...
44
votes
6answers
7k views

Virus Encoded in Video

So I'm not familiar at all with IT Security, but I'm a bit curious about something. I was watching a TV show and at one point, a virus spreads through an office. They investigate and find out that the ...
1
vote
1answer
64 views

Sketchy traffic from port 3030?

I am running tests on a server that is ran by a close family friend, who agreed to allow me to do so in exchange for the experience I will gather (I am currently a computer science student). On ...
1
vote
1answer
160 views

Possible shellcode mailed to me

When I opened my email this morning I found a rather odd message in my mail box. It didn't seem like your every day spam email as it looked like a base64 encoded string and nothing else. Here is a ...
3
votes
1answer
195 views

What encoding could this be? Looks similar to base64 [closed]

I'm currently doing a pen test and there are these 48 character tokens. I identified the first 22 as base64 encoded values I know. The second part (26 characters) looks base64-ish but it's not. It ...
1
vote
1answer
70 views

All UTF-8 characters for generated passwords

Why do a lot of password generators don't generate strong passwords including chinese, arabian...-characters? All generators I saw, also the included one in my password manager keepass, just output ...
1
vote
2answers
155 views

XSS via REQUEST_URI

Is there any situation where an XSS attack can be performed via the PHP $_SERVER['REQUEST_URI'] variable? For those unfamiliar with it: It contains the complete URL used to access that website, ...
2
votes
1answer
578 views

application/json Content-Type character set

According to the OWASP Application Security Verification Standard: V11.3 Verify that every HTTP response contains a content type header specifying a safe character set (e.g., UTF-8). According ...
3
votes
2answers
261 views

Is there a need to have XSS filters when I'm saving data as XML?

My web-app takes some configs from the user and saves into an XML file (it was not done to stop XSS). The input is XML encoded so that the ",& ... and such characters don't break the XML ...
0
votes
2answers
1k views

Effectively Pentest a Wordpress Site

When it comes to blackbox pentesting of a Wordpress site, the first thing to come to mind is WPScan [http://wpscan.org/]. While pentesting some sites, I faced a common issue i.e it shows that ...
1
vote
0answers
60 views

Is it dangerous to append search query to the base URL?

I'm testing drupal website and I've noticed that search query gets appended to the base URL in the response, like so: query: "hey ho: there" http://www.baseurl.com/search/node/hey ho%3A there query: ...
0
votes
1answer
112 views

What is the encoding of that string? [closed]

I try to find the encoding of a string. I thought at first it was Base64, but actually not, it seems ... Let me explain quickly. For a exercise, I have to decode the following string: ...
0
votes
1answer
122 views

Choosing encoder for payloads in metasploit

I noticed that every payload (for example bind_tcp) in metasploit comes with defaut encoder.( shikata_ga_nai for bind_tcp). Is there a way in metasploit to manualy choose encoding for payloads or way ...
0
votes
1answer
223 views

Is it possible to avoid PHP string validation with malformed UTF-8 string?

Some of the old PHP string functions for example explode() are working with UTF-8 strings, but they don't work properly on malformed UTF-8 strings. Is this a security issue? Is it possible to avoid ...
0
votes
0answers
282 views

Can everyone find the pictures one sends over whatsapp?

I was trying out a whatsapp compatible chat application on my laptop. Someone sent me a picture and I received a link to that picture on the whatsapp server. Everyone who visits the link can see the ...
1
vote
1answer
64 views

What could happen if regex metacharacters using named capturing group are not encoded?

Let's say that a web application take a specific input from the user (e.g., search form), apply a Java regex with named caputring groups on it and use the final output to do other stuff (e.g., look ...
4
votes
3answers
1k views

Security Implications of using Base64 Encoding with Encryption

Are there any security implications of converting a byte-array encryption key into a Base64 string before use? I am creating a generic encryption helper for a project, and for the sake of consistency ...
2
votes
3answers
1k views

How can I bypass double quotes in a attribute based xss attack

The code that I have is: <input type="text" name="some_name" value="<?php echo CHtml::encode($str); ?>" /> $str is the input data. 'CHtml::encode()' is Yii's way of encoding special ...
0
votes
1answer
156 views

How to decode/decrypt strings of text [closed]

So I'm trying to decrypt/decode some text strings. I don't believe they're hashes because they vary in length too much and the software they are used for is able to easily decode them and display them ...
4
votes
2answers
2k views

UTF-7 XSS attacks in modern browsers

I've recently read about utf-7 XSS-attacks (i.e. Ned Batchelders article at http://nedbatchelder.com/blog/200704/xss_with_utf7.html) but could not get any UTF-7 attack to work in modern browsers. (I ...
1
vote
1answer
176 views

Could I XSS a page that filters &,",< and > characters and has Content-Type set to UTF-8?

I am trying to pentest a dummy website that has a form with a TEXTAREA input on one page. When the form is submitted, the contents of the form are displayed on a second page. However, the second page ...
0
votes
1answer
64 views

Can any ECC field element be safely serialized as “compressed” and then restored as uncompressed?

I have a library that stores all its ECC Field Elements in uncompressed form, in a bloated Base64 XML format, and storage has become a concern. (We want to support QR code as a form factor,etc) ...
8
votes
2answers
4k views

Exploiting PHP via GET params

To be clear, this is in the interest of ethical testing to secure an application on behalf of my work. Now that that's out of the way, here are the details: Un-sanitised GET params are used in a ...
7
votes
2answers
1k views

PHP: if charset mismatches (htmlentities UTF-8) viewed by client as ISO-8859-1 (or vice versa)

Short Question: Question: Could any security vulnerabilities arise if a server runs htmlentities as UTF-8 but the client views the results as ISO-8859-1? Assumption: No vulnerabilities exist when ...
1
vote
2answers
107 views

Is storing passwords associated with system processes and binaries in an encoded format acceptable?

When a system must go from a powered down state to a fully operational state without any human intervention it therefore needs access to usable authentication credentials unattended. The system must ...
2
votes
0answers
367 views

XSS in HTML title tag without forward slash

I am trying to find out whether this is vulnerable against XSS: I can control the content of the title tag through the URL. This would make the site vulnerable if it wasn't for the fact that the site ...
8
votes
1answer
18k views

PKCS7 encoding in Java without external libs like BouncyCastle etc

I am working on signing and encoding of CMS/PKCS#7 messages (something similar to C# SignedCms). I have x509certificate from the keystore, rsa private key, ContentInfo. ContentType is "oidPkcs7Data". ...
0
votes
1answer
201 views

How do I determine the algorithm used on an encrypted string? [duplicate]

I have a Microsoft Access database which contains encrypted data: When I copy-paste it, it looks like $ 8F). How can I determine the used encryption algorithm? How can I convert this to readable ...
2
votes
1answer
3k views

SHA1 hash encoded with base64 results not consistent?

When i take a hash of user input test123+ i get the following base64 result:- YaddchSU52yztwIMdtHzkg3p1oA= The results have been obtained using the online sha1 convertor I m failing to understand how ...
0
votes
1answer
482 views

XSS - Quote Breaking

First of all i don't know if this question already mention here, believe me i search already. so i was trying to break string inside single and double quote of attr below; ...
2
votes
1answer
322 views

.NET provides 8+ ways to encode data to prevent XSS attacks. Which one should I use when? [closed]

I'm looking at ways to use .NET to prevent XSS attacks and have come across the following methods to encode data: string asdf = WebUtility.UrlEncode(code); string asdf1 = ...
0
votes
1answer
173 views

Is it possible to insert data into UUID?

Is it possible to insert arbitrary data into UUID? Let's suppose we have an MD5\SHA hash of something... can we encode that data into a valid UUID?
0
votes
2answers
63 views

Prevention from cross site scripting in different scenerio?

I could not validate malicious characters like ' .< > etc because these characters are required in my application. Also I could not encode characters because user supposed to enter HTML tags in my ...
1
vote
0answers
22 views

Is Webgoat's HTTP Splitting Attack corrupt? [duplicate]

This link describes my problem better: https://code.google.com/p/webgoat/issues/detail?id=42 I was doing the HTTP Splitting exercise in WebGoat. In this exercise, when you send a malformed URL, you ...
1
vote
3answers
272 views

Are Modern Servers susceptible to HTTP Splitting Attacks

Note: I know how HTTP Splitting works. Note 2: I am not working in WebGoat. I am trying to make this on my own. I am trying to imitate the HTTP Splitting attack on my machine. For that I wrote this ...
3
votes
3answers
281 views

Can a mismatched server encoding on HTTP POST or GET result in a security issue?

It is possible for a server to parse HTTP POST and GET data with a fixed encoding or one that is dynamic with the client's response. Consider the situation where a client uses UTF7,32 or any other ...
4
votes
1answer
7k views

URLEncode vs HTMLEncode for XSS prevention

I have one project (in Java) that the programmer used URLEncode to output content as part of HTML instead of HTMLEncode. What is the risk that it is XSS vulnerable? (Let’s forget that it’s different ...
0
votes
1answer
581 views

XSS: What type of text encoding is this? [closed]

I found this encoding as a XSS example to bypass certain filters. Been trying to look some information (plus encoder/decoder tool) about this type of encoding but was pretty difficult without knowing ...
4
votes
2answers
626 views

Unknown Asian/Chinese registry keys

On a Windows Server 2008 machine found registry key "潓瑦慷敲卜湹潣敶祲" under HKEY_CURRENT_USER of the administrator account. It contains a value "敓癲捩剥湵楮杮" of type REG_DWORD which is set to 0. I scanned the ...
3
votes
1answer
616 views

Why does broad based malware use XOR obfuscation?

As per title... The malware can easily be de-obfuscated if it was obfuscated using common and known XOR techniques. Why don't malware authors use any other method that make it much harder to ...
3
votes
2answers
85 views

SPAM postscript

I have been getting a lot of SPAM lately that have some type of encoded block added to the end. I am wondering if anyone here would know how to decode it. Here is an example: ...
-6
votes
4answers
10k views

How to decrypt LDAP passwords Hashed as MD5? [closed]

I am doing a penetration test, and i would like to know if i can decrypt passwords stored in LDAP. i tried some sites decrypt MD5 , they give me error message tells that the input is not MD5. Could ...
6
votes
1answer
937 views

Reducing password length with hash function

Suppose I would like to use a very long string as a password. As an example we can just say this string is 100 characters in length. However, suppose the application for which I would like to use ...
4
votes
2answers
6k views

HTML encoding to protect against XSS

While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
16
votes
4answers
5k views

Is $_SERVER[ ] a safe source of data in PHP?

Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]? Thanks. OVERVIEW OF RESPONSES: So it seems there is a consensus that some ...
1
vote
1answer
229 views

Understanding nibbles & encoding using owasp EnDe tool?

I'm using owasp EnDe web-based tool to understand nibbles and encoding in general. This online utility in my knowledge is the best free resource avaiable for anyone who is interested to learn encoding ...