I need help for this. I got a request but I don't know what can I do:

GET http://localhost/xor.php?plaintext=cipher=%00%00%1D%10%1A,%06%05%16%16%0D%12%0B%3A9%5DRT%06YVD HTTP/1.1

Full request : https://imgur.com/w9tvNee

I already tried with url decode for decode at the cipher=... but i got nothing interesting.

i got new on this request i got in plaintext= jenesuispasleflag1337 so that gives

http://localhost/xor.php?plaintext=jenesuispasleflag1337&cipher=%00%00%1D%10%1A,%06%05%16%16%0D%12%0B%3A9%5DRT%06YVD HTTP/1.1

  • Based on the the parameter names of the request, I wonder if it is not only encoded but also encrypted. – bradbury9 Mar 18 '19 at 15:43
  • 1
    If you want ppl to help you diagnose your xor.php that belongs to you, you should post this question under stackoverflow with the source. – mootmoot Mar 18 '19 at 16:19

This looks like percent-encoded Unicode strings. Taking a rough pass at the string just based on sight: it looks like there are two strings that are comma separated.

The first string: %00%00%1D%10%1A starts with two null bytes, which is probably why your decoder isn't working: it's very likely stopping processing at the null bytes since most systems interpret that as an "end of data" marker by default.

Decoding back to the characters themselves gets you a mix of printable and non-printable chars:

  • Without the code, I doubt it is the case. – mootmoot Mar 18 '19 at 16:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.