google-webfonts-helper VS CyberChef

I use https://gwfh.mranftl.com/ to grab the fonts and CSS for local use.

If you do want to self-host the fonts, there is a handy Web Fonts helper which generates the CSS and lets you download the .woff2 files you’ll need.

google webfonts helper - https://gwfh.mranftl.com

According to the Cloudflare December monthly stats, I had roughly 57k unique users, 15m requests, 1,3TB traffic. Though, most requests are likely to be bots/integrators spamming the API...

Running on a bare metal k8s cluster (libvirt) on top of a single dedicated Hetzner server, ~70€/month. Not going to monetize it, but will maybe accept donations/sponsorings in the future...

However I felt like this solution is quite opionated, and therefore I'd like to promote a different non-opionated solution (if anyone haven't heard of it yet) to get any font plus minimalistic styles: https://github.com/majodev/google-webfonts-helper

Just moved off https://github.com/majodev/google-webfonts-helper today from their free tier to my own private infra and replaced current the Heroku dyno with a 301: https://github.com/kenmickles/heroku-redirect

AFAIK sadly Heroku does not provide some other _free_ permanent redirect option for *.herokuapp.com apps without actually running a dyno there.

Let me throw in this little life safer here, that generates the CSS and bundles the font files for you: https://google-webfonts-helper.herokuapp.com/

As an alternative there is the google-webfonts-helper. It can be used online and regardless of the operating system.

As you can see, the font loading with Google Fonts can be complicated. However, you can reduce how many requests are needed to just one by self-hosting the font and putting the @font-face declaration inside your CSS bundle instead of an external stylesheet. A tool like Google Webfonts Helper can be helpful for this.

Then we take the encrypted text and use CyberChef to decrypt it.

Let's go to CyberChef and insert our pieces of evidence.

A parameter was changed from '2AMBCgIQBg' to 'CgIIAdgDAQ%3D%3D' which is just the correct base64 encoding they should have been using the entire time.

I don't think this was a hostile action by Google, I think someone just added better input validation for security reasons and it accidently broke the bad requests they were sending.

https://gchq.github.io/CyberChef/#recipe=URL_Decode()From_Ba...

❗This is indeed the flag, but the text is encrypted with Base64. Usually, the presence of padding character "=" indicates that's Base64 type of encoding (but that's only one of the hints). To decrypt it, we can use CyberChef. Copy-paste the text and we either:

It uses a combination of magic bytes (like the `file` command), entropy analysis and character frequency detection to determine whether an output is likely to be of interest to the user.

The file type mechanism is written here[0]. There's a list of all signatures we detect here[1].

[0] https://github.com/gchq/CyberChef/blob/master/src/core/lib/F...

I think this can be deciphered using CyberChef...