I've been learning about ethical hacking, and utilizing the wonderful resources that helpful organization like OWASP and OpenDNS have provided for learning and testing. However, I sometimes come up against challenges that I'm not sure are 'real world' examples. I recently found a challenge that required me to notice that the filename on a web application was converted from ASCII to HEX to obscure the file name.

My question is simply this: Is ASCII to HEX obscurity something relatively common real world? If I'm someday helping a company find vulnerabilities, would this be something I should keep high/mid/low my list of vulnerabilities to look for?

I've worked in I.T. for over 8 years, and I'm not sure I recall seeing HEXed versions of filenames used for obscurity before,so I'm just trying to get some context.

  • hex filenames are often a SHA of the contents; great for versioning and sharing common files
    – dandavis
    May 8, 2017 at 4:44
  • Interesting point. I'll keep that in mind. Do you have any examples of common software that does this? This wasn't the case in this lab I was referring to. It was just straight-up ASCII to HEX conversion, but thank you for contributing.
    – beauk
    May 8, 2017 at 13:31
  • moodle's file uploads, MEGA file sharing service, and many lesser-known ones.
    – dandavis
    May 8, 2017 at 13:33

1 Answer 1


Nope - it's a contrived situation for CTFs. Helps to train you in dealing with different encodings.

Security by obscurity has a niche place, but only as a layer on top of a more robust security framework. Typically you would need a very specific threat scenario for obscurity to make sense as a risk mitigation technique.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .