57
ICAg represents three spaces when text is base64-encoded.
For example:
echo -n ' hello world' | openssl base64
produces:
ICAgICAgaGVsbG8gd29ybGQ=
51
The Zodiac killer ciphers are an interesting case. As there were four ciphers sent to the local papers, I will address each in turn. They do share some common traits however.
They are each their own cipher, so the 'solution' used for cipher 408 cannot be applied to the other messages.
Each message has a unique character count.
The Zodiac Killer sent these ...
43
Hash functions output binary data, usually as a byte array. This cannot be displayed correctly, therefore, you need encoding.
Transmitting binary data can create problems, especially in protocols that are designed to deal with textual data. To avoid it altogether, we don't transmit binary data. Many of the programming errors related to encryption on Stack ...
34
Lets look at this example payload (A), encoded once (B) and twice (C):
A. <script> alert(1) </script>
B. %3Cscript%3E alert(1) %3C%2Fscript%3E
C. %253Cscript%253E alert(1) %253C%252Fscript%253E
Double encoding can be used to bypass XSS filters when different parts of the applicaition makes different assumptions about if a variable is encoded or ...
31
The accepted answer doesn't show how to get the answer (it shows, how to verify it). Use
echo 'ICAgICAgICAgICAgICAg' | base64 -d
(producing a bunch of spaces) or
echo 'ICAgICAgICAgICAgICAg' | base64 -d | hexdump -C
producing
00000000 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |
0000000f
to see what's inside.
26
You're assuming that they're actually encrypted. A lot of crazy people have written things that nobody understands. Just because the author thinks they're in code doesn't necessarily mean that the code can be reversed.
15
This exploit is only possible in old versions of Internet Explorer. Modern browsers will not auto detect the encoding as UTF-7.
OWASP:-
This does not work in any modern browser without changing the encoding type which is why it is marked as completely unsupported.
Wikipedia:-
To mitigate this problem systems should perform decoding before validation ...
14
the registry key is the result of some kind of encoding error.
This.
潓瑦慷敲卜湹潣敶祲
encoded in UTF-16LE (Windows's usual encoding for Unicode strings) is the byte sequence:
53 6f 66 74 77 61 72 65 5c 53 79 6e 63 6f 76 65 72 79
Which represents the ASCII string:
Software\Syncovery
So it would seem Syncovery called a Win32 Unicode API to write a registry ...
13
The problem
Abusing character encodings is a popular trick to get XSS to work even when there are filters in place. There are a number of different situations when it works, but they all share common prerequesits:
The attacker sends a payload in character encoding A.
The server doing the filtering or sanitazion is working in character encoding B.
The ...
13
What you see as the MD5 hash is the hex encoded version of it. The hash itself is binary, but we usually don't like to see binary data on screen. Another way to display the hash is using Base64, so all chars are printable.
Encrypted strings are binary too, so you will want to encode them as base64 too. Or if you want a vintage encoding, try uuencode.
11
To answer your questions, we have to understand what malware in an mp4 file actually means.
An mp4 file isn't an executable, so it will not run any (malicious) code directly. Therefore, if a mp4 file contains malware that wants to execute instructions, it has to exploit a vulnerability (e.g. a buffer overflow) in the program that plays the file. This can ...
9
The simplistic scenario would be to try and send --><?php phpinfo();?><!--. If the <?php tag is escaped, then this would result in
<!-- -->
<?php phpinfo();
<!-- -->
(newlines added for clarity). But the presence of <?php ...?> in the HTML page might not be enough; the PHP code needs to be interpreted server side, not ...
9
No, that's not going to fool spambots. I've seen a couple of spambots that were parsing the entire DOM using tools like html5lib or comparables. Of course, many spammers just "guess" at email addresses: the cost of sending emails when you have a botnet is basically 0, so making combinations of username & domains to guess works out well.
Slightly ...
8
The encode() method HTML encodes characters, which is the correct XSS prevention method in this context.
So if a " character was inserted inside of $str to try and break out of the HTML attribute context, this would be converted to " or " which is the HTML representation.
Therefore it is not possible to inject script here, assuming encode ...
8
This come as an addition to Anders answer (which is great btw).
My understanding is that it is mostly old versions of IE where this is
a problem. But I do not have a source for that, and I am not sure, so
I would be happy to see another answer where it is clarified.
Yes, this affect modern browsers.
Let's take the following sanitization :
<?php
...
6
Wordpress is attacked 3.5 times more often than non-CMSes. WPScan is a great tool that's been around since the BackTrack Linux days.
However, there are more tools and techniques available. Here is a list of some newer tools:
https://github.com/RamadhanAmizudin/Wordpress-scanner
https://github.com/enddo/wp-plugin-scanner
https://github.com/0xBADCA7/wp-...
6
Chrome and Firefox seem to no longer support UTF-7 in any format. The HTML5 specification says:
User agents must support the encodings defined in the WHATWG Encoding standard. User agents should not support other encodings.
User agents must not support the CESU-8, UTF-7, BOCU-1 and SCSU encodings. [CESU8] [UTF7] [BOCU1] [SCSU]
Support for ...
6
If it looks like base64 but isn't quite, it might be base64 with a custom alphabet. This is something that malware writers do to avoid detection (e.g., with data being exfiltrated) and that web application developers do when they think they're being clever (they're usually quite wrong, thinking it's harder to suss out than it is).
I haven't tried to do so, ...
6
This sequence:
a b a b a b a b
H1 E3 B8 W6 Z4 S0 X1 K4
b b b b b b b b
S8 E3 O2 W6 G6 S0 C0 K4
a a a a a a a a
H1 L3 B8 H5 Z4 D7 X1 Z8
tells that there is a key being used to scramble the input password, much like XOR, except most uses of XOR would output in hex while this output is base36?
This sequence
A B A B A B A B
B0 ...
6
I would really love to see this filter getting bypassed.
Let me be the first to fulfill your wish with the so underevaluated and forgotten %0d%0apayload :
Your code :
<script>
// TODO
// document.write("<%= encode(req.getParameter("choice")) %>")
</script>
Request : http://supersecure.com/?choice=%0d%0aalert(1);//
Resulting code :
&...
6
"%5c" (encoded backslash) is commonly used to circumvent sanitisation of the "../" (forward slash) in a URL - tries to stop directory transversal via the URL. As you can't have a backslash in a URL it needs to be encoded.
So if the forwardslash is blocked the backslash may work - allowing the attack.
I've seen this more often on IIS attacks rather than ...
6
Ultimately ... It wouldn't matter
at best this key substitution would equiv to a Caesar cipher ... which can be easily broken.
Qwerty
The quick brown fox jumped over the lazy dog
Dvorak
Yd. 'gcjt xpr,b urq hgml.e rk.p yd. na;f eri
online translator
6
This depends on the context. I am assuming you're using htmlentities() function, which would be generally safe. It does more or less the exact same thing as htmlspecialchars() does.
Both of which secure against general XSS, and prevent event-based XSS when the sanitized parameter is injected into a HTML tag.
They both do not prevent javascript: attacks, ...
6
I think you may have a misconception here; Base64 is not necessarily used to protect information. It has the advantage that it can convert mostly any type of byte encoding into a human-readable ASCII stream. This is extremely useful for sending, say, via email, like with an attachment or image in the email.
There's many cases where it's just used to mask ...
5
As far as I'm aware, there's no security issue.
The "dangerous" characters in HTML (less-than, greater-than, ampersand, single quote, double quote) all have identical byte values under UTF-8 and ISO-8859-1 (and virtually every other encoding you're likely to encounter, with the exceptions of UTF-16, UTF-32, and EBCDIC). As a result, escaping them in one ...
5
Well there are more complex obfuscation techniques. For instance metamorphic and polymorphic malware.
There is an article on searchsecurity by Margareth Rose detailing how this works:
Metamorphic and polymorphic malware are two categories of malicious
software programs (malware) that have the ability to change their code
as they propagate.
...
5
By looking at A= "Tg==" and B= "Tw==" and base 64 decode these values you'll get A= "N" and B= "O" which triggered me as it looks like some sort of substitution.
In your case they used double encoding because as it turned out, it is ROT13, which actually stands for ROTate 13 times:
Now in order to decode your message, you'll first have to base 64 decode ...
5
To answer your two specific examples:
Most Western computer systems don't have fonts with complete coverage of CJK characters, and when they do, the appearance isn't always correct. Having a password displayed to you as a series of boxes isn't particularly useful, and worse, some programs will replace those un-displayable characters with substitutes, ...
Only top voted, non community-wiki answers of a minimum length are eligible
