community VS CyberChef

The JSON Schema organization is looking for honest feedback on how we can make our Community Working Meetings and Office Hours more engaging with the community. We would love to see new recurrent faces in there to help improve JSON Schema.

Did you attend an Office Hours or Open Community Working Meeting in the last 12 months?

If so, please fill in this 1 minute survey to help us improve!

https://docs.google.com/forms/d/e/1FAIpQLSenQIBMSQ1LZ2Y5Ar-35FgL9q3KQ9Y3dyHiDwljbjOzrYs3uw/viewform

You can also find a record of this discussion here: https://github.com/json-schema-org/community/issues/566

At crossref.org we are building out a form-based application using this library, and also working on the development of the VueJS/Vuetify renderer set https://github.com/eclipsesource/jsonforms-vuetify-renderers.

The UISchema is a compromise, and I think that largely is a result of the limitations of JSON Schema when applied to form generation - it's good, but it's not perfect.

There is an open discussion on the JSON Schema GH about creating a custom JSON Schema vocabulary for form generation, which could answer some of these limitations https://github.com/json-schema-org/community/discussions/70

Then we take the encrypted text and use CyberChef to decrypt it.

Let's go to CyberChef and insert our pieces of evidence.

A parameter was changed from '2AMBCgIQBg' to 'CgIIAdgDAQ%3D%3D' which is just the correct base64 encoding they should have been using the entire time.

I don't think this was a hostile action by Google, I think someone just added better input validation for security reasons and it accidently broke the bad requests they were sending.

https://gchq.github.io/CyberChef/#recipe=URL_Decode()From_Ba...

❗This is indeed the flag, but the text is encrypted with Base64. Usually, the presence of padding character "=" indicates that's Base64 type of encoding (but that's only one of the hints). To decrypt it, we can use CyberChef. Copy-paste the text and we either:

It uses a combination of magic bytes (like the `file` command), entropy analysis and character frequency detection to determine whether an output is likely to be of interest to the user.

The file type mechanism is written here[0]. There's a list of all signatures we detect here[1].

[0] https://github.com/gchq/CyberChef/blob/master/src/core/lib/F...

I think this can be deciphered using CyberChef...