string-is VS CyberChef

I use https://string.is/ for this and any other decoding needs (base64/url/tons more).

String.is also comes in a Docker container

Once you get to know about https://string.is/, your search will end, and you'll live happily ever after.

It's written with TypeScript + Next.js, with a comprehensive test suite. There's a hosted version available, or the Readme has one-click install buttons for Vercel and Heroku. It should be easy to run on your own hardware too.

5. It should try to detect the format of the input, and intelligently choose output options.

The last point in particular I feel is an improvement on most existing services - paste in some text and it will try to auto-detect the format and convert it accordingly (although admittedly detection of some formats is a bit primitive currently).

It's built with TypeScript + Next.js. In addition to the hosted version, the GitHub README has one-click install buttons for Vercel and Heroku, plus Docker images.

Source: https://github.com/recurser/string-is

Demo: https://string.is/ (click 'load an example' to get a random converter)

More info: https://string.is/about

There are a couple of other tools in this space if you're interested in alternatives:

  - https://gchq.github.io/CyberChef/ (online)

Thanks! Feel free to drop an issue on GitHub if you have any ideas for useful additions

Then we take the encrypted text and use CyberChef to decrypt it.

Let's go to CyberChef and insert our pieces of evidence.

A parameter was changed from '2AMBCgIQBg' to 'CgIIAdgDAQ%3D%3D' which is just the correct base64 encoding they should have been using the entire time.

I don't think this was a hostile action by Google, I think someone just added better input validation for security reasons and it accidently broke the bad requests they were sending.

https://gchq.github.io/CyberChef/#recipe=URL_Decode()From_Ba...

❗This is indeed the flag, but the text is encrypted with Base64. Usually, the presence of padding character "=" indicates that's Base64 type of encoding (but that's only one of the hints). To decrypt it, we can use CyberChef. Copy-paste the text and we either:

It uses a combination of magic bytes (like the `file` command), entropy analysis and character frequency detection to determine whether an output is likely to be of interest to the user.

The file type mechanism is written here[0]. There's a list of all signatures we detect here[1].

[0] https://github.com/gchq/CyberChef/blob/master/src/core/lib/F...

I think this can be deciphered using CyberChef...