Once again, this is used in the Black Hills Information Security Cyber Range and if you like it for Base64 encoding and decoding data, thank you. And as you can see, it actually cleans up the output substantially in doing that. You’re going to decode this Base64 encoded string.Īnd if you come across something that you don’t quite understand, just don’t worry. Now if you’re dealing with a string that has Base64 and it throws in some special characters, you can throw in the -i switch and with the -i switched does is it tells Base64, ignore garbage. Basically be like, mmm, there’s something wrong here. And in doing that, any type of firewall or IDS that’s using deep packet inspection to analyze that Base64 encoded data, will start throwing errors. What some crafty attackers will do is they’ll actually slip special characters in their Base64 encoded stream. The reason why is very slight changes can actually alter signatures in a much more significant way whenever you’re doing signature pattern matching within an executable. Well, a lot of malware actually uses Base64. The reason why is I snuck in a couple of special characters in the middle of the Base64 encoded string. You can see right here it says, “I’m sure there is a” and then it goes ahh! Base64 invalid input. And now whenever I hit enter, it’s going to try to decode it and it’s going to freak out. Now I utilized a switch, here you can see I did the –decode switch. Let me bounce out here and I’m just going to use straight-up Base64 decode. Now if we actually want to decode Base64 encoded data, we can, in fact, do that. That means the text landed on a perfect boundary and that’s okay, but it’s just something to look for.

Many times a telltale giveaway are the equal signs at the end, one or two. If your character set that’s coming in doesn’t land perfectly on the boundaries that Base64 is looking for, it’ll actually pad it. Now, one of the things you’ll notice is sometimes with Base64 or a lot of the times it will end with “equals equals” and that has to do with padding. It allows it to encode it in a way that it’s easily transferred over clear text or plain text protocols. As you can see, we have the, I am sure and the space and all that has been replaced with what looks like gibberish, but it’s pretty much not malicious gibberish or mostly not malicious gibberish I suppose.

And we’re going to pipe it through Base64. Now, in my example that I have up on my screen, we’re going to be playing around with, “I am sure there’s a better way to do this434343!!!!!!” or capital C, capital C, capital C in hex but we’re not at that video yet. Let’s play around a little bit with encoding and decoding Base64 and then some of the little challenges that you’re going to run into. You’ll see it all the time whenever you’re doing web application, security assessments, looking at security parameters and tokens, and things of that nature. It allows you to convert things like binary and special character data into something that’s far less benign like upper lower case and numbers and that’s what we actually get whenever we’re utilizing Base64 as an encoding mechanism. This is why protocols like this exist or different encoding formats like this exist. In fact, we see this all the time, especially with attacks like SQL where semi-colons get interpreted and get executed. For example, if you’re looking at something like HTTP, transports a lot of text and if we start sending binary, we might get into trouble. Whenever you are transferring binary data or you’re transferring data with special characters, it can be encoded and it can be garbled, especially whenever you’re dealing with protocols that are designed predominantly for sending text. Now the reason why Base64 actually exists is kind of interesting. Now the reason why we’re talking about it is once again we have the BHIS Cyber Range for our customers and friends and this is just basically a video to walk people through some of the challenges that utilize Base64. My name is John Strand and in this video, we’re going to be talking about Base64 encoding and decoding.

Youtube base64 encoding