57
votes
Accepted
What does this "ICAgICAg…" mean in public key certificates and messages?
ICAg represents three spaces when text is base64-encoded.
For example:
echo -n ' hello world' | openssl base64
produces:
ICAgICAgaGVsbG8gd29ybGQ=
- 19.6k
51
votes
Accepted
Why haven't (most of) the Zodiac Killer's letters been decrypted?
The Zodiac killer ciphers are an interesting case. As there were four ciphers sent to the local papers, I will address each in turn. They do share some common traits however.
They are each their own ...
- 501
45
votes
Accepted
Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?
Hash functions output binary data, usually as a byte array. This cannot be displayed correctly, therefore, you need encoding.
Transmitting binary data can create problems, especially in protocols that ...
- 5,389
35
votes
Accepted
When and why does bypassing XSS sanitizers with double encoding work?
Lets look at this example payload (A), encoded once (B) and twice (C):
A. <script> alert(1) </script>
B. %3Cscript%3E alert(1) %3C%2Fscript%3E
C. %253Cscript%253E alert(1) %253C%...
- 64.2k
31
votes
What does this "ICAgICAg…" mean in public key certificates and messages?
The accepted answer doesn't show how to get the answer (it shows, how to verify it). Use
echo 'ICAgICAgICAgICAgICAg' | base64 -d
(producing a bunch of spaces) or
echo 'ICAgICAgICAgICAgICAg' | ...
- 684
26
votes
Why haven't (most of) the Zodiac Killer's letters been decrypted?
You're assuming that they're actually encrypted. A lot of crazy people have written things that nobody understands. Just because the author thinks they're in code doesn't necessarily mean that the ...
- 82k
15
votes
Accepted
How to check if an mp4 file contains malware?
To answer your questions, we have to understand what malware in an mp4 file actually means.
An mp4 file isn't an executable, so it will not run any (malicious) code directly. Therefore, if a mp4 file ...
- 7,214
14
votes
Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?
What you see as the MD5 hash is the hex encoded version of it. The hash itself is binary, but we usually don't like to see binary data on screen. Another way to display the hash is using Base64, so ...
- 50.3k
13
votes
Accepted
How is character encodings used to bypass XSS sanitizers?
The problem
Abusing character encodings is a popular trick to get XSS to work even when there are filters in place. There are a number of different situations when it works, but they all share common ...
- 64.2k
10
votes
Accepted
HTML Entities to hide Email Addresses
No, that's not going to fool spambots. I've seen a couple of spambots that were parsing the entire DOM using tools like html5lib or comparables. Of course, many spammers just "guess" at email ...
- 15.8k
8
votes
How can I bypass double quotes in a attribute based xss attack
The encode() method HTML encodes characters, which is the correct XSS prevention method in this context.
So if a " character was inserted inside of $str to try and break out of the HTML attribute ...
- 33.2k
8
votes
How is character encodings used to bypass XSS sanitizers?
This come as an addition to Anders answer (which is great btw).
My understanding is that it is mostly old versions of IE where this is
a problem. But I do not have a source for that, and I am not ...
- 2,874
7
votes
Accepted
What encoding could this be? Looks similar to base64
If it looks like base64 but isn't quite, it might be base64 with a custom alphabet. This is something that malware writers do to avoid detection (e.g., with data being exfiltrated) and that web ...
- 71.7k
6
votes
Effectively Pentest a Wordpress Site
Wordpress is attacked 3.5 times more often than non-CMSes. WPScan is a great tool that's been around since the BackTrack Linux days.
However, there are more tools and techniques available. Here is a ...
- 18.9k
6
votes
UTF-7 XSS attacks in modern browsers
Chrome and Firefox seem to no longer support UTF-7 in any format. The HTML5 specification says:
User agents must support the encodings defined in the WHATWG Encoding standard. User agents should ...
- 161
6
votes
Odd password scrambling algorithm
This sequence:
a b a b a b a b
H1 E3 B8 W6 Z4 S0 X1 K4
b b b b b b b b
S8 E3 O2 W6 G6 S0 C0 K4
a a a a a a a a
H1 L3 B8 H5 Z4 D7 X1 Z8
tells that there is a key being used to ...
- 6,797
6
votes
Accepted
Is this filter safe enough to mitigate XSS?
I would really love to see this filter getting bypassed.
Let me be the first to fulfill your wish with the so underevaluated and forgotten %0d%0apayload :
Your code :
<script>
// TODO
// ...
- 2,874
6
votes
Accepted
Function of %5c.. in a path traversal
"%5c" (encoded backslash) is commonly used to circumvent sanitisation of the "../" (forward slash) in a URL - tries to stop directory transversal via the URL. As you can't have a backslash in a URL it ...
- 3,262
6
votes
Would using a QWERTY keyboard with DVORAK output cause keylogger to log DVORAK?
Ultimately ... It wouldn't matter
at best this key substitution would equiv to a Caesar cipher ... which can be easily broken.
Qwerty
The quick brown fox jumped over the lazy dog
Dvorak
Yd. '...
- 7,478
6
votes
Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context?
This depends on the context. I am assuming you're using htmlentities() function, which would be generally safe. It does more or less the exact same thing as htmlspecialchars() does.
Both of which ...
- 222
6
votes
Accepted
What's the purpose of Base64 if knowing its Base64 makes it easy to decode
I think you may have a misconception here; Base64 is not necessarily used to protect information. It has the advantage that it can convert mostly any type of byte encoding into a human-readable ASCII ...
- 176
5
votes
Accepted
Benefit to specifying JSON Content-Type character set?
Your biggest risk would be older versions of Internet Explorer that attempt to auto-detect the encoding as UTF-7 - called Codepage Sniffing.
It appears that Internet Explorer will only do this for ...
- 33.2k
5
votes
Accepted
What is the encoding of that string?
By looking at A= "Tg==" and B= "Tw==" and base 64 decode these values you'll get A= "N" and B= "O" which triggered me as it looks like some sort of substitution.
In your case they used double ...
- 5,763
5
votes
Accepted
All UTF-8 characters for generated passwords
To answer your two specific examples:
Most Western computer systems don't have fonts with complete coverage of CJK characters, and when they do, the appearance isn't always correct. Having a ...
- 34.4k
5
votes
PHP: if charset mismatches (htmlentities UTF-8) viewed by client as ISO-8859-1 (or vice versa)
As far as I'm aware, there's no security issue.
The "dangerous" characters in HTML (less-than, greater-than, ampersand, single quote, double quote) all have identical byte values under UTF-8 and ISO-...
- 34.4k
5
votes
Accepted
The purpose of escaping html entities
Any decent static analysis scanner would not flag up a vulnerability if you were storing raw HTML in your database - after all, it's only a string.
String sequences only become dangerous when passed ...
- 33.2k
5
votes
Accepted
Is it a bad idea to use base-64 encoded strings for passwords?
All questions of the type "Will this clever trick make my password any safer?" depends on the same thing: What passwords does the attacker try first when brute forcing the hash? The person attacking ...
- 64.2k
5
votes
Accepted
Directory traversal only works with URL-encoded "%00" char in the end
%00 is the URL-encoded version of a null byte character. In some applications you can inject a null byte to prematurely terminate a string. An attacker may take advantage of this to cut the end of a ...
- 43.7k
Only top scored, non community-wiki answers of a minimum length are eligible