Re: [Full-disclosure] Cipher detection

[Cal Leeming <cal@xxxxxxxxxxxxxxxx>]

lol thor ;p

Max, can you give a little more information as to the source of this? Are
you able to give us more samples? (preferably, dummy@xxxxxxxxxxxx,
dummy@xxxxxxxxxx, and test).

If it's using a one time pad, you've got no chance lol, but sometimes these
things just use realllllly heavily obfuscated lookup/convert tables, which
can be reversed most of the time.

Cal

On Thu, Apr 7, 2011 at 5:39 PM, Thor (Hammer of God)
<thor@xxxxxxxxxxxxxxx>wrote:

>  Actually it is a valid Base64 string – it just decodes to 24, 106, 27,
> 67, 102, 236, 169, 222, 184, 61, 117, 64, 153, 160, 226, 12, 24.  To get
> dummy@xxxxxxxxxxx you would have to XOR that resulting binary string with
> 124, 31, 118, 46, 31, 172, 108, 174, 217, 80, 5, 44, 124, 142, 129, 99, 117
> which I don’t see any pattern in (close to that anyway, I did it in my head
> so I’m sure I screwed up some of them).  Maybe someone sees something…   Of
> course, Cal could have done it, which means it’s probably Matrix for
> “titties.”  :-p
>
>
>
> The input and output are both 17 bytes, so an XOR makes sense, but another
> 17 character example would help.  And a 20.
>
>
>
> t
>
>
>
>
>
>
>
> *From:* full-disclosure-bounces@xxxxxxxxxxxxxxxxx [mailto:
> full-disclosure-bounces@xxxxxxxxxxxxxxxxx] *On Behalf Of *
> Maksim.Filenko@xxxxxxxx
> *Sent:* Thursday, April 07, 2011 1:23 AM
> *To:* full-disclosure@xxxxxxxxxxxxxxxxx
> *Subject:* [Full-disclosure] Cipher detection
>
>
>
> Hi Full-Disclosure,
>
> I'm trying to figure out what kind of cipher was used in this:
>
> GGobQ2bsqd64PXVAmaDiDBg=
>
> Looks like Base64, but it's not. The original string is:
>
> dummy@xxxxxxxxxxx
>
> Thanks all!
>
> wbr,
>  - Max
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/