62 votes
Accepted

Randomly generated secrets: encoding the random bytes in base64 vs keeping them

It doesn't matter. A number doesn't change because you change the encoding of it. 1012 and 510 is the same number, and contain the same amount of information. The reason we use base64 is that it is ...
vidarlo's user avatar
  • 15.4k
58 votes
Accepted

What does this "ICAgICAg…" mean in public key certificates and messages?

ICAg represents three spaces when text is base64-encoded. For example: echo -n ' hello world' | openssl base64 produces: ICAgICAgaGVsbG8gd29ybGQ=
mti2935's user avatar
  • 22.7k
51 votes
Accepted

Why haven't (most of) the Zodiac Killer's letters been decrypted?

The Zodiac killer ciphers are an interesting case. As there were four ciphers sent to the local papers, I will address each in turn. They do share some common traits however. They are each their own ...
WhataTiberius's user avatar
45 votes
Accepted

Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?

Hash functions output binary data, usually as a byte array. This cannot be displayed correctly, therefore, you need encoding. Transmitting binary data can create problems, especially in protocols that ...
kelalaka's user avatar
  • 5,519
35 votes
Accepted

When and why does bypassing XSS sanitizers with double encoding work?

Lets look at this example payload (A), encoded once (B) and twice (C): A. <script> alert(1) </script> B. %3Cscript%3E alert(1) %3C%2Fscript%3E C. %253Cscript%253E alert(1) %253C%...
Anders's user avatar
  • 65.4k
31 votes

What does this "ICAgICAg…" mean in public key certificates and messages?

The accepted answer doesn't show how to get the answer (it shows, how to verify it). Use echo 'ICAgICAgICAgICAgICAg' | base64 -d (producing a bunch of spaces) or echo 'ICAgICAgICAgICAgICAg' | ...
maaartinus's user avatar
26 votes

Why haven't (most of) the Zodiac Killer's letters been decrypted?

You're assuming that they're actually encrypted. A lot of crazy people have written things that nobody understands. Just because the author thinks they're in code doesn't necessarily mean that the ...
tylerl's user avatar
  • 83.3k
20 votes
Accepted

How to check if an mp4 file contains malware?

To answer your questions, we have to understand what malware in an mp4 file actually means. An mp4 file isn't an executable, so it will not run any (malicious) code directly. Therefore, if a mp4 file ...
Demento's user avatar
  • 7,429
17 votes

Randomly generated secrets: encoding the random bytes in base64 vs keeping them

As you say, base64 uses 4/3 times as many symbols to represent the same value. Each symbol of base64 encodes 6 bits, instead of 8. That's a ratio of 3/4. (4/3) * (3/4) = 1. The information content is ...
hobbs's user avatar
  • 647
14 votes

Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?

What you see as the MD5 hash is the hex encoded version of it. The hash itself is binary, but we usually don't like to see binary data on screen. Another way to display the hash is using Base64, so ...
ThoriumBR's user avatar
  • 53.5k
13 votes
Accepted

How is character encodings used to bypass XSS sanitizers?

The problem Abusing character encodings is a popular trick to get XSS to work even when there are filters in place. There are a number of different situations when it works, but they all share common ...
Anders's user avatar
  • 65.4k
11 votes

Randomly generated secrets: encoding the random bytes in base64 vs keeping them

The binary password has 256^n possibilities, where n is the password length in bytes. The base64 password has 64^(n*4/3) possibilities, where n is the original password length in bytes and, since the ...
Thomas Weller's user avatar
8 votes

How is character encodings used to bypass XSS sanitizers?

This come as an addition to Anders answer (which is great btw). My understanding is that it is mostly old versions of IE where this is a problem. But I do not have a source for that, and I am not ...
Xavier59's user avatar
  • 2,904
7 votes

How to determine what type of encoding/encryption has been used?

This is very weak security on all fronts! The plaintext is P4$$w0rdP4$$w0rd and it's encrypted using XOR encryption, with the key CdZ4MLMPgYtAE9gQ80gMtg==. This produces the ciphertext posted by the ...
mti2935's user avatar
  • 22.7k
7 votes
Accepted

Function of %5c.. in a path traversal

"%5c" (encoded backslash) is commonly used to circumvent sanitisation of the "../" (forward slash) in a URL - tries to stop directory transversal via the URL. As you can't have a backslash in a URL it ...
ISMSDEV's user avatar
  • 3,270
6 votes

Effectively Pentest a Wordpress Site

Wordpress is attacked 3.5 times more often than non-CMSes. WPScan is a great tool that's been around since the BackTrack Linux days. However, there are more tools and techniques available. Here is a ...
atdre's user avatar
  • 19k
6 votes
Accepted

Is this filter safe enough to mitigate XSS?

I would really love to see this filter getting bypassed. Let me be the first to fulfill your wish with the so underevaluated and forgotten %0d%0apayload : Your code : <script> // TODO // ...
Xavier59's user avatar
  • 2,904
6 votes

Would using a QWERTY keyboard with DVORAK output cause keylogger to log DVORAK?

Ultimately ... It wouldn't matter at best this key substitution would equiv to a Caesar cipher ... which can be easily broken. Qwerty The quick brown fox jumped over the lazy dog Dvorak Yd. '...
CaffeineAddiction's user avatar
6 votes

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context?

This depends on the context. I am assuming you're using htmlentities() function, which would be generally safe. It does more or less the exact same thing as htmlspecialchars() does. Both of which ...
Cillian Collins's user avatar
6 votes
Accepted

What's the purpose of Base64 if knowing its Base64 makes it easy to decode

I think you may have a misconception here; Base64 is not necessarily used to protect information. It has the advantage that it can convert mostly any type of byte encoding into a human-readable ASCII ...
moltarze's user avatar
  • 176
6 votes
Accepted

What is LS0... encoding of a PKI certificate?

I would suggest that this is just base64 encoded PEM: $ echo "-----BEGIN CERTIFICATE-----" | base64 LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCg== $ echo "-----BEGIN CERTIFICATE-----" | ...
Steffen Ullrich's user avatar
6 votes

Passing a C# object to Javascript in ASP.NET MVC

Use an HTML data-* attribute to store the object as JSON and later parse it with JS. This has several security and design advantages over injecting directly into an inline <script>. Example Let'...
Arminius's user avatar
  • 44.7k
5 votes
Accepted

Is it a bad idea to use base-64 encoded strings for passwords?

All questions of the type "Will this clever trick make my password any safer?" depends on the same thing: What passwords does the attacker try first when brute forcing the hash? The person attacking ...
Anders's user avatar
  • 65.4k
5 votes
Accepted

Directory traversal only works with URL-encoded "%00" char in the end

%00 is the URL-encoded version of a null byte character. In some applications you can inject a null byte to prematurely terminate a string. An attacker may take advantage of this to cut the end of a ...
Arminius's user avatar
  • 44.7k
5 votes
Accepted

Hydra - Attacking when login page encodes the username and password

As the code clearly indicates, the name, password, and verification token are hashed together before being sent over the network. So, no, you cannot figure out which is which just from the network ...
schroeder's user avatar
  • 128k
5 votes

Do ciphers and encoding schemes make passwords more secure?

"and then use the result as their master password on LastPass" The proposed "algorithm" is in essence just a fancy key expansion. As you surmised, it is security through obscurity. If one knew that ...
LSerni's user avatar
  • 22.8k
5 votes

Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?

While the other answers contain plenty of good information, I think they missed the original point. This is a URL shortener. So Length is a critical factor. An MD5 hash gives you 128 1's and 0's. ...
noslenkwah's user avatar
4 votes
Accepted

Dumping custom query via SQL injection when output is in the die() function?

You need to figure out if the parameter is being parsed as an integer or a string (most probably as string). If the query is balanced and successful, It won't die(). try .. 1' order by 1-- - or .. ...
Mukarram Khalid's user avatar
4 votes
Accepted

Malicious link? Apache?

It's an IP address in octal format, followed by an arbitrary path, which happens to be formed of elements that look like query parameters. You can generate octal representations of IP addresses using ...
Matthew's user avatar
  • 27.4k

Only top scored, non community-wiki answers of a minimum length are eligible