4 ms·

Has anyone checked if it is just a serialized+base64 encoded swift proto with the original URL? There could be other reasons for this, but evading firefox rewr

Has anyone checked if it is just a serialized+base64 encoded swift proto with the original URL? There could be other reasons for this, but evading firefox rewriting links seems most likely - some gateways strip too-long query strings for example, but will leave the rest of the URL alone.

Volker_W 4y ago
> some gateways strip too-long query strings for example Uhm. What?
grishka 4y ago
$ echo "0RjTS7KpBAGt9FHp5vCNmRJsnmBudyqRsPC7ovp8sh2EWFxve1Mk2HaGTKoRSuVKpl" | base64 -D | xxd 00000000: d118 d34b b2a9 0401 adf4 51e9 e6f0 8d99 ...K......Q..... 00000010: 126c 9e60 6e77 2a91 b0f0 bba2 fa7c b21d .l.`nw*......|.. 00000020: 8458 5c6f 7b53 24d8 7686 4caa 114a e54a .X\o{S$.v.L..J.J $ echo "AZXT7WeYMEs7icO80N5ynjE2WpFuQK61pIv4kMN-dnAz27-UrYqrkv52_hQlS_TuPd8dGUNLawATILFs55sMUJvH7SFRqb_WcD6CCOX_zYdsebOW0TWyJ9gT2vxBJPZiAaEaac_zQBShE-UEJfatT-JMQT5-bvmrLz7NlgwSeL6fGKH9oY9uepTio0BHyCmoY1A" | base64 -D | xxd 00000000: 0195 d3ed 6798 304b 3b89 c3bc d0de 729e ....g.0K;.....r. 00000010: 3136 5a91 6e40 aeb5 a48b f890 c37e 7670 16Z.n@.......~vp 00000020: 33db bf94 ad8a ab92 fe76 fe14 254b f4ee 3........v..%K.. 00000030: 3ddf 1d19 434b 6b00 1320 b16c e79b 0c50 =...CKk.. .l...P 00000040: 9bc7 ed21 51a9 bfd6 703e 8208 e5ff cd87 ...!Q...p>...... 00000050: 6c79 b396 d135 b227 d813 dafc 4124 f662 ly...5.'....A$.b 00000060: 01a1 1a69 cff3 4014 a113 e504 25f6 ad4f ...i..@.....%..O 00000070: e24c 413e 7e6e f9ab 2f3e cd96 0c12 78be .LA>~n../>....x. 00000080: 9f18 a1fd a18f 6e7a 94e2 a340 47c8 29a8 ......nz...@G.). This doesn't look to me like unencrypted serialized data. Serialization would usually have some visible structure to it and possibly visible ASCII strings. Also notice that the lengths of both strings are aligned to 16 bytes — this might mean AES block encryption.

Volker_W 4y ago

> some gateways strip too-long query strings for example Uhm. What?

grishka 4y ago

$ echo "0RjTS7KpBAGt9FHp5vCNmRJsnmBudyqRsPC7ovp8sh2EWFxve1Mk2HaGTKoRSuVKpl" | base64 -D | xxd 00000000: d118 d34b b2a9 0401 adf4 51e9 e6f0 8d99 ...K......Q..... 00000010: 126c 9e60 6e77 2a91 b0f0 bba2 fa7c b21d .l.`nw*......|.. 00000020: 8458 5c6f 7b53 24d8 7686 4caa 114a e54a .X\o{S$.v.L..J.J $ echo "AZXT7WeYMEs7icO80N5ynjE2WpFuQK61pIv4kMN-dnAz27-UrYqrkv52_hQlS_TuPd8dGUNLawATILFs55sMUJvH7SFRqb_WcD6CCOX_zYdsebOW0TWyJ9gT2vxBJPZiAaEaac_zQBShE-UEJfatT-JMQT5-bvmrLz7NlgwSeL6fGKH9oY9uepTio0BHyCmoY1A" | base64 -D | xxd 00000000: 0195 d3ed 6798 304b 3b89 c3bc d0de 729e ....g.0K;.....r. 00000010: 3136 5a91 6e40 aeb5 a48b f890 c37e 7670 16Z.n@.......~vp 00000020: 33db bf94 ad8a ab92 fe76 fe14 254b f4ee 3........v..%K.. 00000030: 3ddf 1d19 434b 6b00 1320 b16c e79b 0c50 =...CKk.. .l...P 00000040: 9bc7 ed21 51a9 bfd6 703e 8208 e5ff cd87 ...!Q...p>...... 00000050: 6c79 b396 d135 b227 d813 dafc 4124 f662 ly...5.'....A$.b 00000060: 01a1 1a69 cff3 4014 a113 e504 25f6 ad4f ...i..@.....%..O 00000070: e24c 413e 7e6e f9ab 2f3e cd96 0c12 78be .LA>~n../>....x. 00000080: 9f18 a1fd a18f 6e7a 94e2 a340 47c8 29a8 ......nz...@G.). This doesn't look to me like unencrypted serialized data. Serialization would usually have some visible structure to it and possibly visible ASCII strings. Also notice that the lengths of both strings are aligned to 16 bytes — this might mean AES block encryption.