I'm currently doing a pen test and there are these 48 character tokens. I identified the first 22 as base64 encoded values I know.

The second part (26 characters) looks base64-ish but it's not. It sometimes contains a dash or a dot. Here are three examples:




I'm not asking you to tell me what the values mean, just a hint which encoding it could be. It's a Java EE web application.

  • 1
    Are the characters '/' and '+' also used, or may '-' and '.' be actual replacement for those? In the latter case, this would be sort of URL / file name safe form of base64 encoding, as presented in RFC 3548 – WhiteWinterWolf Apr 20 '15 at 11:48
  • The attackers in the Target breach used a modified base64 where they replaced / and + with other characters. You could be looking at something as simple as that. – gowenfawr Apr 20 '15 at 12:06
  • Thanks, maybe it's actually that simple. I haven't seen / and + in the tokens. I'll report back! – Prinzhorn Apr 20 '15 at 12:09
  • I assume you were right but I was not able to do anything with it (I assume the 20 bytes are SHA-1). Anyway, does one of you want to post this as an answer? Maybe others haven't heard of alternative base64 alphabets. – Prinzhorn Apr 20 '15 at 12:49

If it looks like base64 but isn't quite, it might be base64 with a custom alphabet. This is something that malware writers do to avoid detection (e.g., with data being exfiltrated) and that web application developers do when they think they're being clever (they're usually quite wrong, thinking it's harder to suss out than it is).

I haven't tried to do so, but given a large enough encoded text sample, deciphering the custom alphabet used is quite possible. You just need to determine the contents of the alphabet, then it's a reconcilable problem to just try different orders out.

(If you build the custom alphabet and it's not 64 characters, it might be another base. There's nothing magical about base64. If I recall correctly you can even go crazy wild like base53.)

Not the answer you're looking for? Browse other questions tagged or ask your own question.