57 votes
Accepted

What does this "ICAgICAg…" mean in public key certificates and messages?

ICAg represents three spaces when text is base64-encoded. For example: echo -n ' hello world' | openssl base64 produces: ICAgICAgaGVsbG8gd29ybGQ=
user avatar
  • 19.6k
51 votes
Accepted

Why haven't (most of) the Zodiac Killer's letters been decrypted?

The Zodiac killer ciphers are an interesting case. As there were four ciphers sent to the local papers, I will address each in turn. They do share some common traits however. They are each their own ...
user avatar
45 votes
Accepted

Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?

Hash functions output binary data, usually as a byte array. This cannot be displayed correctly, therefore, you need encoding. Transmitting binary data can create problems, especially in protocols that ...
user avatar
  • 5,389
35 votes
Accepted

When and why does bypassing XSS sanitizers with double encoding work?

Lets look at this example payload (A), encoded once (B) and twice (C): A. <script> alert(1) </script> B. %3Cscript%3E alert(1) %3C%2Fscript%3E C. %253Cscript%253E alert(1) %253C%...
user avatar
  • 64.2k
31 votes

What does this "ICAgICAg…" mean in public key certificates and messages?

The accepted answer doesn't show how to get the answer (it shows, how to verify it). Use echo 'ICAgICAgICAgICAgICAg' | base64 -d (producing a bunch of spaces) or echo 'ICAgICAgICAgICAgICAg' | ...
user avatar
26 votes

Why haven't (most of) the Zodiac Killer's letters been decrypted?

You're assuming that they're actually encrypted. A lot of crazy people have written things that nobody understands. Just because the author thinks they're in code doesn't necessarily mean that the ...
user avatar
  • 82k
15 votes
Accepted

How to check if an mp4 file contains malware?

To answer your questions, we have to understand what malware in an mp4 file actually means. An mp4 file isn't an executable, so it will not run any (malicious) code directly. Therefore, if a mp4 file ...
user avatar
  • 7,214
14 votes

Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?

What you see as the MD5 hash is the hex encoded version of it. The hash itself is binary, but we usually don't like to see binary data on screen. Another way to display the hash is using Base64, so ...
user avatar
  • 50.3k
13 votes
Accepted

How is character encodings used to bypass XSS sanitizers?

The problem Abusing character encodings is a popular trick to get XSS to work even when there are filters in place. There are a number of different situations when it works, but they all share common ...
user avatar
  • 64.2k
10 votes
Accepted

HTML Entities to hide Email Addresses

No, that's not going to fool spambots. I've seen a couple of spambots that were parsing the entire DOM using tools like html5lib or comparables. Of course, many spammers just "guess" at email ...
user avatar
  • 15.8k
8 votes

How can I bypass double quotes in a attribute based xss attack

The encode() method HTML encodes characters, which is the correct XSS prevention method in this context. So if a " character was inserted inside of $str to try and break out of the HTML attribute ...
user avatar
8 votes

How is character encodings used to bypass XSS sanitizers?

This come as an addition to Anders answer (which is great btw). My understanding is that it is mostly old versions of IE where this is a problem. But I do not have a source for that, and I am not ...
user avatar
  • 2,874
7 votes
Accepted

What encoding could this be? Looks similar to base64

If it looks like base64 but isn't quite, it might be base64 with a custom alphabet. This is something that malware writers do to avoid detection (e.g., with data being exfiltrated) and that web ...
user avatar
  • 71.7k
6 votes

Effectively Pentest a Wordpress Site

Wordpress is attacked 3.5 times more often than non-CMSes. WPScan is a great tool that's been around since the BackTrack Linux days. However, there are more tools and techniques available. Here is a ...
user avatar
  • 18.9k
6 votes

UTF-7 XSS attacks in modern browsers

Chrome and Firefox seem to no longer support UTF-7 in any format. The HTML5 specification says: User agents must support the encodings defined in the WHATWG Encoding standard. User agents should ...
user avatar
6 votes

Odd password scrambling algorithm

This sequence: a b a b a b a b H1 E3 B8 W6 Z4 S0 X1 K4 b b b b b b b b S8 E3 O2 W6 G6 S0 C0 K4 a a a a a a a a H1 L3 B8 H5 Z4 D7 X1 Z8 tells that there is a key being used to ...
user avatar
  • 6,797
6 votes
Accepted

Is this filter safe enough to mitigate XSS?

I would really love to see this filter getting bypassed. Let me be the first to fulfill your wish with the so underevaluated and forgotten %0d%0apayload : Your code : <script> // TODO // ...
user avatar
  • 2,874
6 votes
Accepted

Function of %5c.. in a path traversal

"%5c" (encoded backslash) is commonly used to circumvent sanitisation of the "../" (forward slash) in a URL - tries to stop directory transversal via the URL. As you can't have a backslash in a URL it ...
user avatar
  • 3,262
6 votes

Would using a QWERTY keyboard with DVORAK output cause keylogger to log DVORAK?

Ultimately ... It wouldn't matter at best this key substitution would equiv to a Caesar cipher ... which can be easily broken. Qwerty The quick brown fox jumped over the lazy dog Dvorak Yd. '...
user avatar
6 votes

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context?

This depends on the context. I am assuming you're using htmlentities() function, which would be generally safe. It does more or less the exact same thing as htmlspecialchars() does. Both of which ...
user avatar
6 votes
Accepted

What's the purpose of Base64 if knowing its Base64 makes it easy to decode

I think you may have a misconception here; Base64 is not necessarily used to protect information. It has the advantage that it can convert mostly any type of byte encoding into a human-readable ASCII ...
user avatar
  • 176
5 votes
Accepted

Benefit to specifying JSON Content-Type character set?

Your biggest risk would be older versions of Internet Explorer that attempt to auto-detect the encoding as UTF-7 - called Codepage Sniffing. It appears that Internet Explorer will only do this for ...
user avatar
5 votes
Accepted

What is the encoding of that string?

By looking at A= "Tg==" and B= "Tw==" and base 64 decode these values you'll get A= "N" and B= "O" which triggered me as it looks like some sort of substitution. In your case they used double ...
user avatar
  • 5,763
5 votes
Accepted

All UTF-8 characters for generated passwords

To answer your two specific examples: Most Western computer systems don't have fonts with complete coverage of CJK characters, and when they do, the appearance isn't always correct. Having a ...
user avatar
  • 34.4k
5 votes

PHP: if charset mismatches (htmlentities UTF-8) viewed by client as ISO-8859-1 (or vice versa)

As far as I'm aware, there's no security issue. The "dangerous" characters in HTML (less-than, greater-than, ampersand, single quote, double quote) all have identical byte values under UTF-8 and ISO-...
user avatar
  • 34.4k
5 votes
Accepted

The purpose of escaping html entities

Any decent static analysis scanner would not flag up a vulnerability if you were storing raw HTML in your database - after all, it's only a string. String sequences only become dangerous when passed ...
user avatar
5 votes
Accepted

Is it a bad idea to use base-64 encoded strings for passwords?

All questions of the type "Will this clever trick make my password any safer?" depends on the same thing: What passwords does the attacker try first when brute forcing the hash? The person attacking ...
user avatar
  • 64.2k
5 votes
Accepted

Directory traversal only works with URL-encoded "%00" char in the end

%00 is the URL-encoded version of a null byte character. In some applications you can inject a null byte to prematurely terminate a string. An attacker may take advantage of this to cut the end of a ...
user avatar
  • 43.7k

Only top scored, non community-wiki answers of a minimum length are eligible