Spotting base64 encoded JSON, certificates, and private keys
1–10 of 135 posts
Re: Spotting base64 encoded JSON, certificates, and private keys
#2Oh that's nifty. Spotting base64 encoded strings is easy enough (and easy enough to test that I give it a shot if I'm even vaguely curious), but I'd never looked at them closely enough to spot patterns.
Re: Spotting base64 encoded JSON, certificates, and private keys
#3Oh that's nifty. Spotting base64 encoded strings is easy enough (and easy enough to test that I give it a shot if I'm even vaguely curious), but I'd never looked at them closely enough to spot patterns.
After copy and pasting enough access tokens into various tools you pick up on it pretty fast.
Re: Spotting base64 encoded JSON, certificates, and private keys
#4There is a Base64 quasi-fixed point:
$ echo -n Vm0 | base64
Vm0w
Re: Spotting base64 encoded JSON, certificates, and private keys
#5Something similar pops up if you have to spend a lot of time looking at binary blobs with a hex editor. Certain common character sequences become familiar. This also leads to choosing magic numbers in data formats that decode to easily recognized ASCII strings. I'm sure if I worked with base64 I'd be choosing something that encoded nicely into particular strings for the same purpose.
Re: Spotting base64 encoded JSON, certificates, and private keys
#6There is a Base64 quasi-fixed point: $ echo -n Vm0 | base64 Vm0w It can be extended indefinitely one character at a time, but there will always be some suffix.
Note that the suffix will grow in length with the input, making it less and less interesting.
(Because the output is necessarily 8/6 the size of the input, the suffix always adds 33% to the length.)
Re: Spotting base64 encoded JSON, certificates, and private keys
#7I discovered this when I created a JWT system for my internship. I got really good at spotting JWTs, or any base64 encoded json payloads in our Kafka streams
Re: Spotting base64 encoded JSON, certificates, and private keys
#8I don't really love this. It just feels so wasteful.
JWT does it as well.
Even in this example, they are double base64 encoding strings (the salt).
It's really too bad that there's really nothing quite like json. Everything speaks it and can write it. It'd be nice if something like protobuf was easier to write and read in a schemeless fashion.
Re: Spotting base64 encoded JSON, certificates, and private keys
#9I love this post style. Never stop learning friend!
Re: Spotting base64 encoded JSON, certificates, and private keys
#10I built a JWT support library at work (https://github.com/geldata/gel-rust/tree/master/gel-jwt) and I can confirm that JWTs all sound like "eyyyyyy" in my head.