imgproxy VS CyberChef

We use imgproxy which does 2->4 and all you need to do is change the URL on your site.

imgproxy interactive demo

You should also be using a variety of formats. Unless you need support for old browsers and transparency in the same image, don't use PNG. Stick with jpg, webp and avif. You can setup something like imgproxy to automatically resize and change format of images, or even fit into the space requirements you set.

If you look for something universal, you can try API for image optimization (e.g. imgproxy). However, the mechanism is different from build-time optimization.

Hey everyone, seeking some feedback about how to improve our project, imgproxy, an open source image processing tool.It’s designed to reduce costs and remove pricey requirements for all saved images to conform to specific formats. You can read the full list here if you’re curious: https://github.com/imgproxy/imgproxy In addition to crucial image processing stuff (like resizing, cropping, rotating), it can also sign urls, add watermarks, and a ton of other things.A ton of developers use it, and that’s great. We’re trying to improve it further, so wanted to put out the feelers and see if there is anyone using it (or a similar tool) who could suggest some additional features (or tell about the essential features of your current image processing tool).

Now signup for Vultr and make a $5 instance and put imgproxy on it. Setup a subdomain for images in Cloudflare and point it to the imgproxy IP.

Then we take the encrypted text and use CyberChef to decrypt it.

Let's go to CyberChef and insert our pieces of evidence.

A parameter was changed from '2AMBCgIQBg' to 'CgIIAdgDAQ%3D%3D' which is just the correct base64 encoding they should have been using the entire time.

I don't think this was a hostile action by Google, I think someone just added better input validation for security reasons and it accidently broke the bad requests they were sending.

https://gchq.github.io/CyberChef/#recipe=URL_Decode()From_Ba...

❗This is indeed the flag, but the text is encrypted with Base64. Usually, the presence of padding character "=" indicates that's Base64 type of encoding (but that's only one of the hints). To decrypt it, we can use CyberChef. Copy-paste the text and we either:

It uses a combination of magic bytes (like the `file` command), entropy analysis and character frequency detection to determine whether an output is likely to be of interest to the user.

The file type mechanism is written here[0]. There's a list of all signatures we detect here[1].

[0] https://github.com/gchq/CyberChef/blob/master/src/core/lib/F...

I think this can be deciphered using CyberChef...