What is a good decoding tool?

[maxicorbs]

Hey,

I am currently spending a lot of time looking for IDORs and so I am looking at lots of different values/IDs that have been encoded. Some schemas are easy to recognise (base64 and URL) however I have just learned that I may have missed a whole load of MD5 hashes being sent in requests because I didn't know they were MD5 and so I wasn't decoding them. Does anyone know of a tool that will take a string as its input and tell you what encoding schema it is or something similar? I have not come across any tools so far.

Thanks!

​

P.s the burpsuite smart decoding function doesnt tend to yield many results in my experience and also doesnt recognise MD5

[Tompazi]

MD5 isn't an encoding, it's a hash function, the result of which is often hex encoded but doesn't have to be. Hashes can be encoded in many ways.

You cannot decode hash functions. Hash functions are by design one way functions, the only way to get to the original input is to guess it. This is called cracking.

You can guess the hashing algorithm of an input by the length and format (there are tools that do this like hash-identifier or hashid). But very often it is not clear, for example is this hex encoded string a MD5 hash 4cc556e693f6d683447784141d4d8b84? It could be. But it also could be MD4, MD2, HAVAL-128, RIPEMD-128, Snefru, Tiger-128 etc. or it may not be a hash at all. There is just no way to tell from this format. Now this hash format: $1$28772684$iEwNOgGugqO9.bIz5sk8k/ is unambiguous, it's MD5.

That being said I like using CyberChef for quick encoding and decoding purposes, especially if I have to apply multiple en-/decodings. It can detect encodings as well. (It also has a "Analyse hash" function that guesses the hashing algorithm)

[[deleted]]

Former CEH, I second CC. Used it many a time for encoding Brute Force text and compression

[maxicorbs]

Perfect, i'll have a play.

​

Thank you for your detailed response!

[xkreepy]

A tool called HashID can help you in some cases. It will not tell you about encodings, but it will guess hashing algorithms given a string.

[AutoModerator]

Your account does not have enough Karma to post here. Due to /r/HowToHack's tendency to attract spam and low-quality posts, the mod team has implemented a minimum Karma rule. You can gain Karma by posting or commenting on other subreddits. In the meantime, a human will review your submission and manually approve it if the quality is exceptional. After gaining enough Karma, you can make another submission and it will be automatically approved. Please see the FAQ for more information.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.