🍩
HackBook.io
  • Pentesting Pocket Book for hackers and developers.
  • Reconnaissance
    • Internal Recon Basics
    • OSINT
      • Infrastructure
      • Recon-ng
      • Users
      • Google Dorks
    • Active Scanning
      • NMAP
        • NSE
          • reconnoitre
        • NMap Evasion
      • NC Scan
      • Finger Printing
    • Web Server OSINT
      • WhatWeb
      • Subdomains
      • Directory & File Enumeration
        • Enumeration
          • GoCutty
          • gobuster
          • Dirb
          • nikto
        • Fuzzing
        • Crawling
  • Web Application Hacking
    • Web 101
      • Clients
      • Servers
      • Encodings
    • Web Hacking Techniques
      • SOP
      • Open Redirect
      • File & Resource Attacks
        • Directory Traversal
          • Dir Traversal Fuzzer
        • LFI
        • RFI
        • Unrestricted File Uploads
      • XSS
        • DOM
        • Stored
        • Reflected
        • Blind
        • Self XSS
      • XXE
        • XXE Payloads
      • XPath
      • SSRF
      • CSRF
      • SQLi
        • SQL Basics
        • Securing SQL
        • Hacking SQL
          • sqlmap
          • In-Band
          • Error Based
          • Blind
      • Authorization
      • Session Hijacking
      • Command Injection
      • Insecure Deserialization
      • File Uploads
        • File Upload Mitigations
      • HPP
      • Click Jacking
        • Adobe SWF Investigator
      • HTTP Response Splitting
      • Flash 101
        • Flash Hacking
      • HTML5
        • WebSockets
        • CORS
          • iframe
          • Headers
    • Web Hacking Procedures
      • Captcha
      • Username Generation
      • Username Enumeration
      • Inhouse WebApps
      • SSL Cert Generation
      • CMS
        • WordPress
        • Joomla
      • Popular Exploits
        • Bludit CMS
        • ShellShock
        • WebDav
  • Weaponization
    • Buffer Overflows (BOF)
      • DSBOFG
        • Scripts
  • Initial Access
    • 😈Services
      • Finger
      • SNMP
      • LDAP
      • SMTP
      • NFS
      • RPC
        • RPCBind
      • RDP
      • SQL
        • NoSQL
      • POP3
      • Samba
      • SMB
      • SSH
      • Telnet
      • NetBios
      • VOIP/SIP
      • DNS
        • DNS Lookups
        • Zone Transfer
        • SubDomain Enums
        • dnsdumpster
    • 😈Shells
      • Powercat
      • Odd Shells
      • Troubleshoot
      • TTY/PTTY
  • Persistence
    • File Transfers
      • Py->Exe->Txt
      • Cross compile example
    • Backdoors
  • Privilege Escalation
    • Universal Escalation
    • Windows Escalation
      • Automated
      • Popular Exploits
        • ActiveXObject to Wscript RCE
        • Macros
        • Object Linking
    • Linux Escalation
      • Automated
    • Passwords
      • John
      • Medusa
      • Cewl
      • ncrack
      • Crunch
      • Hydra
      • MITM
      • Responder
        • SAM
          • pwdump and fgdump
          • Pass-the-hash
      • Crack the hash
      • NTLM
  • Network Discovery
    • Network Traffic
      • tcpdump
    • Internal Discovery
  • Collection and Staging
    • Collection
      • File types
  • Hacking Objectives
    • Non Kinetic War (Quick Guide)
  • Procedures
    • Bash Guide
    • Active Directory
    • Crypto 101
    • Forensics
  • Glossary
  • Hacking Frameworks
    • Metasploit
      • msfvenom
    • Dsnif
  • ThreatModeling
    • Threat Modeling Overview
  • Certifications
    • VMDR
      • Qualys Asset Management
      • Qualys Vulnerability Management
      • Qualys Threat Prioritization
      • Qualys Response (Patch Deployment)
    • OSCP Cheat Sheet
  • RF - Radio Frequency
    • Ham Technician
Powered by GitBook
On this page
  • Base conversions
  • Extending an encoding

Was this helpful?

  1. Web Application Hacking
  2. Web 101

Encodings

PreviousServersNextWeb Hacking Techniques

Last updated 3 years ago

Was this helpful?

The HTTP header will specify what the character encoding is in documents being sent. This allows us to know how we need to trick the encoder. If nothing is specified it will default to ISO-8859-1 (latin 1). Example encoding: Content-Type: text/html; charset=utf-8 Telling the server our content type: -PHP: header('Content-type: text/html; charset=utf-8'); -ASP.NET: <%Response.charset="utf-8"%> -JSP: <%@ page contentType="text/html; charset=UTF-8" %> -HTML: <meta http-equiv="Content-Type" Content="text/html; charset=utf-8"> -HTML5: <meta charset="utf-8">

Base conversions

PHP: <?=base_convert("OHPE",36,10);?> //base 36 to dec(10), flip for encode <?=base64_encode('encode this string')?> //Encode <?=base64_decode('ZW5jb2RlIHRoaXMgc3RyaW5n')?> JS: (1142690).toString(36) //encode, dec to 36 1142690..toString(36) //alternative parseInt("ohpe",36) //decode Win base64: window.btoa('encode this string'); //Encode window.atob('ZW5jb2RlIHRoaXMgc3RyaW5n'); //Decode

Extending an encoding

To include characters that are outside of the encoding character-set or to change a character like < to be the text version. We can use the following syntax: HTML5: &#D; //here we replace D with the Unicode decimal character number &#xH; //here we replace H with the Unicode hexadecimal character number HTML: U+0026 U+0023 D U+003B U+0026 U+0023 U+0058 H U+003B There are also some common ones that don't need hex/dec numbers: &lt; represents the < sign. &gt; represents the > sign. &amp; represents the & sign. &quot; represents the " mark. Reference list for the U+ encodings:

https://html.spec.whatwg.org/#named-character-references