-1

While performing a file upload, a template parameter is sent together with file. Service acts differently when different parameters are passed. I need help to figure out what this parameter contains. Here are two examples:

7b0fc4f83d3fc320ef3865a1b472caeba3f0b60e09f257c61f34af77a7ff57adTB5QO8kXU18KUIgZGXblGYAOC7qbRzizHLGpGdUPbywggHncAkwJVe4M/0w7Dy9svucGrEgYbud0OY5iCFlTalho9j9SWzGMXlWjqU0wrFApBh+/Rqy8v93q1gBlpwLsuj7WBppuWItBmhoOyxkyKLv8Vm6AVVeXxndd4kklq+E= - allows uploading any file

8849c262187451b5f558f4c2f150ec67efaafc192f51b1b8983754090e0c767bb+5SL0SVpqqHUB7zPYvNzEMSanK9r2uL7xUe/TK+9rofXD6gqQpsIKB2P7aECihmfEwEdQaLG6Kz3W5B1wiwxZRbdutdBbRYClAAoZ/bhaTdm2VnPBVZKuisi3cVVM91p2/pjb/qSPor7/026fq9PitSBizAtSbf858/BcTu7sw=H2pFMj+uoRaSnqqPdNbdrZzh3AF9H0uhagE9V7R6V8Ed67HFvGYS/Cg9DReGtlj1n1HtjpV14qqfYt5l/tVesG2B/Xh84tkr14t/RgTUA7cXwn3bWEWUcjxCFWlmAs2RXLs6g1Up3e/g4rolmGO8JAbFwRXWhFQQvZMx1+D5tjM=Tie6y7lK/q6Vlw9ssVYUYDP5Il5dYZxGPtkJSkaOPNGjkin81azLZFdtU7K6wUBcHYOoZzhthYdFMIK8K30UMGPMQI9/d4AKJsATT1PXaw/A1bjkMnapCdJl4IWGNs55IgHEs6mMPENlBuVodjQXJNodIkXOFa+I+q+MlGu0Rls= - allows uploading only images

My guess is that this is a serialized object that contains upload configuration. Are there any ideas how to understand and maybe deserialize these strings?

2
  • The base64 decode is binary that I don't recognize. – user10216038 Jan 20 '20 at 6:13
  • It could be just a string representation of an internal binary object, like a struct... – macro_controller Jan 20 '20 at 8:30
2

Just a brief analyze of data samples you provided.

  • First: 7b0fc4f83d3fc320ef3865a1b472caeba3f0b60e09f257c61f34af77a7ff57adTB5QO8kXU18KUIgZGXblGYAOC7qbRzizHLGpGdUPbywggHncAkwJVe4M/0w7Dy9svucGrEgYbud0OY5iCFlTalho9j9SWzGMXlWjqU0wrFApBh+/Rqy8v93q1gBlpwLsuj7WBppuWItBmhoOyxkyKLv8Vm6AVVeXxndd4kklq+E=

  • Second: 8849c262187451b5f558f4c2f150ec67efaafc192f51b1b8983754090e0c767bb+5SL0SVpqqHUB7zPYvNzEMSanK9r2uL7xUe/TK+9rofXD6gqQpsIKB2P7aECihmfEwEdQaLG6Kz3W5B1wiwxZRbdutdBbRYClAAoZ/bhaTdm2VnPBVZKuisi3cVVM91p2/pjb/qSPor7/026fq9PitSBizAtSbf858/BcTu7sw=H2pFMj+uoRaSnqqPdNbdrZzh3AF9H0uhagE9V7R6V8Ed67HFvGYS/Cg9DReGtlj1n1HtjpV14qqfYt5l/tVesG2B/Xh84tkr14t/RgTUA7cXwn3bWEWUcjxCFWlmAs2RXLs6g1Up3e/g4rolmGO8JAbFwRXWhFQQvZMx1+D5tjM=Tie6y7lK/q6Vlw9ssVYUYDP5Il5dYZxGPtkJSkaOPNGjkin81azLZFdtU7K6wUBcHYOoZzhthYdFMIK8K30UMGPMQI9/d4AKJsATT1PXaw/A1bjkMnapCdJl4IWGNs55IgHEs6mMPENlBuVodjQXJNodIkXOFa+I+q+MlGu0Rls=


  1. First 64 symbols. It could be sha256 hash of file you upload or key for decryption data which encoded in base64;

  2. First part contains single base64 which contains 128 bytes of data. Second example contains 2 parts encoded in base64 separately (splitting data into chunks could be caused by limits for data size of selected encrypting algorithm):

    • First part (decoded data length: 256) b+5SL0SVpqqHUB7zPYvNzEMSanK9r2uL7xUe/TK+9rofXD6gqQpsIKB2P7aECihmfEwEdQaLG6Kz3W5B1wiwxZRbdutdBbRYClAAoZ/bhaTdm2VnPBVZKuisi3cVVM91p2/pjb/qSPor7/026fq9PitSBizAtSbf858/BcTu7sw=H2pFMj+uoRaSnqqPdNbdrZzh3AF9H0uhagE9V7R6V8Ed67HFvGYS/Cg9DReGtlj1n1HtjpV14qqfYt5l/tVesG2B/Xh84tkr14t/RgTUA7cXwn3bWEWUcjxCFWlmAs2RXLs6g1Up3e/g4rolmGO8JAbFwRXWhFQQvZMx1+D5tjM=

    • Second part (decoded data length: 128) Tie6y7lK/q6Vlw9ssVYUYDP5Il5dYZxGPtkJSkaOPNGjkin81azLZFdtU7K6wUBcHYOoZzhthYdFMIK8K30UMGPMQI9/d4AKJsATT1PXaw/A1bjkMnapCdJl4IWGNs55IgHEs6mMPENlBuVodjQXJNodIkXOFa+I+q+MlGu0Rls=

  3. Decoded data of each this parts looks too random, so I suppose that data encoded using one of block cipher symmetric-key algorithms. Why? Because:

    • If data is not encoded 99% of developers will use JSON or XML or whatever else instead of custom structures which means additional work on serializer (all developers are lazy);
    • Length of each block of data is exactly divisible by 16;
    • Weird hash on the start of sample which could be a key or any other input for decryption (length - 64, btw).

It's all interesting information which can be extracted from your samples. Maybe I noticed something you haven't yet, who knows ¯\_(ツ)_/¯

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.