I've been learning about ethical hacking, and utilizing the wonderful resources that helpful organization like OWASP and OpenDNS have provided for learning and testing. However, I sometimes come up against challenges that I'm not sure are 'real world' examples. I recently found a challenge that required me to notice that the filename on a web application was converted from ASCII to HEX to obscure the file name.

My question is simply this: Is ASCII to HEX obscurity something relatively common real world? If I'm someday helping a company find vulnerabilities, would this be something I should keep high/mid/low my list of vulnerabilities to look for?

I've worked in I.T. for over 8 years, and I'm not sure I recall seeing HEXed versions of filenames used for obscurity before,so I'm just trying to get some context.

  • hex filenames are often a SHA of the contents; great for versioning and sharing common files – dandavis May 8 '17 at 4:44
  • Interesting point. I'll keep that in mind. Do you have any examples of common software that does this? This wasn't the case in this lab I was referring to. It was just straight-up ASCII to HEX conversion, but thank you for contributing. – beauk May 8 '17 at 13:31
  • moodle's file uploads, MEGA file sharing service, and many lesser-known ones. – dandavis May 8 '17 at 13:33

Nope - it's a contrived situation for CTFs. Helps to train you in dealing with different encodings.

Security by obscurity has a niche place, but only as a layer on top of a more robust security framework. Typically you would need a very specific threat scenario for obscurity to make sense as a risk mitigation technique.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.