3
$\begingroup$

I am pentesting a database that where I found data which was base64 encoded. I tried the usual method of decoding base64, which didn't work.

Later, I found in database a field called base64_custom_key. How do I decrypt a base64 encoded message with a key?

For eg. The key looks like gP9jOzA75VyIW6FRuHZimQcLB1rCTKpGN8hdEXw0eY3kMx+/JDUntsob4a2qfSv and the value generated looks like ucaUCo4NmA88Tws8BoQsKAXdBcDn

Improve this question
$\endgroup$
4
  • 1
    $\begingroup$ This question clearly asks how to decrypt such a block of data guys, it only includes the block of data as example. I've seen this type of "encryption" before and I think it is valuable to explain that it's a substitution cipher and how to decrypt it. $\endgroup$ – Maarten Bodewes♦ Nov 23 '15 at 7:24
  • $\begingroup$ I don't see the reason to put it on hold. Moderators, care to explain? This isn't about analyzing a specific cipher. $\endgroup$ – ramailo sathi Nov 23 '15 at 18:26
  • $\begingroup$ I think the fact that this is a classical substitution cipher that has been applied in modern time to perform some kind of obfuscation has something to do with it, Abhi. Taht's however not a good close reason. $\endgroup$ – Maarten Bodewes♦ Nov 24 '15 at 14:39
  • $\begingroup$ I would look at this page....just input your information and you will get your results malwaretracker.com/decoder_base64.php $\endgroup$ – grandfinalemike Dec 7 '15 at 15:56
6
$\begingroup$

That's a simple substitution cipher. Base 64 uses the following alphabet A-Za-z0-9+/. Here A encodes 000000, B encodes 000001 etc. In your case the g encodes 000000, P encodes 000001 etc.

Instead of writing your own decoder for that you can simply take the ciphertext, iterate through the characters of the ciphertext and replace g with A, P with B etc. After that you should be able to use a regular base 64 decoder to do the work for you.

Don't replace multiple characters at a time or you'll run into trouble. Put the characters in a new string instead (if you map g to A while there are still other A characters left then your algorithm will certainly fail).

Improve this answer
$\endgroup$
4
  • $\begingroup$ Note that this should be considered "toy encryption". $\endgroup$ – Maarten Bodewes♦ Nov 23 '15 at 3:01
  • $\begingroup$ Thank you so much for the answer. This clearly is a non standard way of encrypting something. :) $\endgroup$ – ramailo sathi Nov 23 '15 at 4:53
  • 1
    $\begingroup$ Note that many programming languages / environments include a built-in tool for such character replacement, e.g. tr/// for Perl, strtr() for PHP, string.translate() for Python, etc. Many of these are modeled on the Unix command-line tool tr. In particular, to decode your example string using Unix tools, just run the command echo ucaUCo4NmA88Tws8BoQsKAXdBcDn | tr 'gP9jOzA75VyIW6FRuHZimQcLB1rCTKpGN8hdEXw0eY3kMx+/JDUntsob4a2qfSv' 'A-Za-z0-9+' | base64 -d. $\endgroup$ – Ilmari Karonen Nov 26 '15 at 15:42
  • 1
    $\begingroup$ ...and, of course, the second argument to tr in my previous comment should be 'A-Za-z0-9+/'. For some reason, I accidentally left the / out. For that particular input string (which does not contain the letter v) the mistake makes no difference, but it could potentially corrupt other inputs. $\endgroup$ – Ilmari Karonen Jan 23 '17 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.