Flycut VS CyberChef

I’ve used flycut and thought it was good https://github.com/TermiT/Flycut

*Flycut *- clean and simple clipboard for Mac - if you ever needed to copy/paste a bunch of things over and over, you know how annoying it is to lose the previous item from your clipboard. Well, never again - with this nifty tool that saves your clipboard history you'll boost your productivity and also become a better person (since you'll be cursing less).

Flycut? https://github.com/TermiT/Flycut

Flycut is a clean and simple free open source clipboard app for macOS and iOS that is based on Jumpcut, a minimal clipboard manager for macOS. Flycut was designed with developers in mind, and its main focus is on code snippets. For this reason, it comes with many hot keys and keyboard shortcuts, which can be customized according to your needs in the preferences panel. On the other hand, Flycut allows you to store only text snippets. This means that images, videos, and tables are currently not supported. It also neither supports Windows nor offers specific integrations for the most common IDEs and text editors. Although Flycut does not come with cloud features natively, you can configure it to sync with your Dropbox account. This way, you can store your clipboard history in an external cloud service and then access it from wherever you want. When Flycut is launched, its icon appears in your menu bar. Every time you copy a text snippet, Flycut stores it in history for you. Using Shift + Command + V, you can access the history and navigate with the right or left arrows to select the item to paste. More advanced search features, as well as ways to organize your clippings, are currently unavailable.

Then we take the encrypted text and use CyberChef to decrypt it.

Let's go to CyberChef and insert our pieces of evidence.

A parameter was changed from '2AMBCgIQBg' to 'CgIIAdgDAQ%3D%3D' which is just the correct base64 encoding they should have been using the entire time.

I don't think this was a hostile action by Google, I think someone just added better input validation for security reasons and it accidently broke the bad requests they were sending.

https://gchq.github.io/CyberChef/#recipe=URL_Decode()From_Ba...

❗This is indeed the flag, but the text is encrypted with Base64. Usually, the presence of padding character "=" indicates that's Base64 type of encoding (but that's only one of the hints). To decrypt it, we can use CyberChef. Copy-paste the text and we either:

It uses a combination of magic bytes (like the `file` command), entropy analysis and character frequency detection to determine whether an output is likely to be of interest to the user.

The file type mechanism is written here[0]. There's a list of all signatures we detect here[1].

[0] https://github.com/gchq/CyberChef/blob/master/src/core/lib/F...

I think this can be deciphered using CyberChef...