62
votes
Accepted
Randomly generated secrets: encoding the random bytes in base64 vs keeping them
It doesn't matter. A number doesn't change because you change the encoding of it.
1012 and 510 is the same number, and contain the same amount of information.
The reason we use base64 is that it is ...
- 15.4k
58
votes
Accepted
What does this "ICAgICAg…" mean in public key certificates and messages?
ICAg represents three spaces when text is base64-encoded.
For example:
echo -n ' hello world' | openssl base64
produces:
ICAgICAgaGVsbG8gd29ybGQ=
- 22.7k
51
votes
Accepted
Why haven't (most of) the Zodiac Killer's letters been decrypted?
The Zodiac killer ciphers are an interesting case. As there were four ciphers sent to the local papers, I will address each in turn. They do share some common traits however.
They are each their own ...
- 501
45
votes
Accepted
Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?
Hash functions output binary data, usually as a byte array. This cannot be displayed correctly, therefore, you need encoding.
Transmitting binary data can create problems, especially in protocols that ...
- 5,519
35
votes
Accepted
When and why does bypassing XSS sanitizers with double encoding work?
Lets look at this example payload (A), encoded once (B) and twice (C):
A. <script> alert(1) </script>
B. %3Cscript%3E alert(1) %3C%2Fscript%3E
C. %253Cscript%253E alert(1) %253C%...
- 65.4k
31
votes
What does this "ICAgICAg…" mean in public key certificates and messages?
The accepted answer doesn't show how to get the answer (it shows, how to verify it). Use
echo 'ICAgICAgICAgICAgICAg' | base64 -d
(producing a bunch of spaces) or
echo 'ICAgICAgICAgICAgICAg' | ...
- 694
26
votes
Why haven't (most of) the Zodiac Killer's letters been decrypted?
You're assuming that they're actually encrypted. A lot of crazy people have written things that nobody understands. Just because the author thinks they're in code doesn't necessarily mean that the ...
- 83.3k
20
votes
Accepted
How to check if an mp4 file contains malware?
To answer your questions, we have to understand what malware in an mp4 file actually means.
An mp4 file isn't an executable, so it will not run any (malicious) code directly. Therefore, if a mp4 file ...
- 7,429
17
votes
Randomly generated secrets: encoding the random bytes in base64 vs keeping them
As you say, base64 uses 4/3 times as many symbols to represent the same value.
Each symbol of base64 encodes 6 bits, instead of 8. That's a ratio of 3/4.
(4/3) * (3/4) = 1. The information content is ...
- 647
14
votes
Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?
What you see as the MD5 hash is the hex encoded version of it. The hash itself is binary, but we usually don't like to see binary data on screen. Another way to display the hash is using Base64, so ...
- 53.5k
13
votes
Accepted
How is character encodings used to bypass XSS sanitizers?
The problem
Abusing character encodings is a popular trick to get XSS to work even when there are filters in place. There are a number of different situations when it works, but they all share common ...
- 65.4k
11
votes
Randomly generated secrets: encoding the random bytes in base64 vs keeping them
The binary password has 256^n possibilities, where n is the password length in bytes.
The base64 password has 64^(n*4/3) possibilities, where n is the original password length in bytes and, since the ...
- 3,376
8
votes
How is character encodings used to bypass XSS sanitizers?
This come as an addition to Anders answer (which is great btw).
My understanding is that it is mostly old versions of IE where this is
a problem. But I do not have a source for that, and I am not ...
- 2,904
7
votes
How to determine what type of encoding/encryption has been used?
This is very weak security on all fronts! The plaintext is P4$$w0rdP4$$w0rd and it's encrypted using XOR encryption, with the key CdZ4MLMPgYtAE9gQ80gMtg==. This produces the ciphertext posted by the ...
- 22.7k
7
votes
Accepted
Function of %5c.. in a path traversal
"%5c" (encoded backslash) is commonly used to circumvent sanitisation of the "../" (forward slash) in a URL - tries to stop directory transversal via the URL. As you can't have a backslash in a URL it ...
- 3,270
6
votes
Effectively Pentest a Wordpress Site
Wordpress is attacked 3.5 times more often than non-CMSes. WPScan is a great tool that's been around since the BackTrack Linux days.
However, there are more tools and techniques available. Here is a ...
- 19k
6
votes
Accepted
Is this filter safe enough to mitigate XSS?
I would really love to see this filter getting bypassed.
Let me be the first to fulfill your wish with the so underevaluated and forgotten %0d%0apayload :
Your code :
<script>
// TODO
// ...
- 2,904
6
votes
Would using a QWERTY keyboard with DVORAK output cause keylogger to log DVORAK?
Ultimately ... It wouldn't matter
at best this key substitution would equiv to a Caesar cipher ... which can be easily broken.
Qwerty
The quick brown fox jumped over the lazy dog
Dvorak
Yd. '...
- 7,692
6
votes
Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context?
This depends on the context. I am assuming you're using htmlentities() function, which would be generally safe. It does more or less the exact same thing as htmlspecialchars() does.
Both of which ...
- 232
6
votes
Accepted
What's the purpose of Base64 if knowing its Base64 makes it easy to decode
I think you may have a misconception here; Base64 is not necessarily used to protect information. It has the advantage that it can convert mostly any type of byte encoding into a human-readable ASCII ...
- 176
6
votes
Accepted
What is LS0... encoding of a PKI certificate?
I would suggest that this is just base64 encoded PEM:
$ echo "-----BEGIN CERTIFICATE-----" | base64
LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCg==
$ echo "-----BEGIN CERTIFICATE-----" | ...
- 198k
6
votes
Passing a C# object to Javascript in ASP.NET MVC
Use an HTML data-* attribute to store the object as JSON and later parse it with JS. This has several security and design advantages over injecting directly into an inline <script>.
Example
Let'...
- 44.7k
5
votes
Accepted
Is it a bad idea to use base-64 encoded strings for passwords?
All questions of the type "Will this clever trick make my password any safer?" depends on the same thing: What passwords does the attacker try first when brute forcing the hash? The person attacking ...
- 65.4k
5
votes
Accepted
Directory traversal only works with URL-encoded "%00" char in the end
%00 is the URL-encoded version of a null byte character. In some applications you can inject a null byte to prematurely terminate a string. An attacker may take advantage of this to cut the end of a ...
- 44.7k
5
votes
Accepted
Hydra - Attacking when login page encodes the username and password
As the code clearly indicates, the name, password, and verification token are hashed together before being sent over the network. So, no, you cannot figure out which is which just from the network ...
- 128k
5
votes
Do ciphers and encoding schemes make passwords more secure?
"and then use the result as their master password on LastPass"
The proposed "algorithm" is in essence just a fancy key expansion.
As you surmised, it is security through obscurity. If one knew that ...
- 22.8k
5
votes
Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?
While the other answers contain plenty of good information, I think they missed the original point. This is a URL shortener. So Length is a critical factor. An MD5 hash gives you 128 1's and 0's. ...
- 273
4
votes
Accepted
Dumping custom query via SQL injection when output is in the die() function?
You need to figure out if the parameter is being parsed as an integer or a string (most probably as string). If the query is balanced and successful, It won't die().
try ..
1' order by 1-- -
or ..
...
- 294
4
votes
Accepted
Malicious link? Apache?
It's an IP address in octal format, followed by an arbitrary path, which happens to be formed of elements that look like query parameters.
You can generate octal representations of IP addresses using ...
- 27.4k
Only top scored, non community-wiki answers of a minimum length are eligible