Become a Bug bounty tutorial: Unit 4: Base64 Encoding

Base64 Encoding

Summary: 

Most web applications make use of Base64 encoding for transmitting

binary data within cookies and other parameters, and even for obfuscating

sensitive data to prevent trivial modification. 

You should always look out for, and decode, any Base64 data that is issued to the client. Base64-encoded

strings can often be easily recognized from their specific character set and the

presence of padding characters at the end of the string.

Explanation:

Base64 encoding allows any binary data to be safely represented using only

printable ASCII characters. It is commonly used for encoding email attach-

ments for safe transmission over SMTP, and is also used to encode user cre-

dentials in basic HTTP authentication.

Base64 encoding processes input data in blocks of three bytes. Each of these

blocks is divided into four chunks of six bits each. Six bits of data allow for 64

different possible permutations, and so each chunk can be represented using a

set of 64 characters. Base64 encoding employs the following character set,

which contains only printable ASCII characters:

ABDEFGIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxy0123456789+/

If the final block of input data results in less than three chunks of output

data, then the output is padded with one or two = characters.

For example, 

VFhlIFdlYjBBcHBsaWNhdGlvbiBIYWNrZXIncyBIYW7kYm9vaw==

(== denotes end of data)