encode
Encodings attackers (and the web) use: base64, hex, URL encoding and ROT13, plus entropy to spot random-looking text such as packed code or generated domains.
import encodeExample
import encode
let b = encode.base64("powershell -nop -w hidden")
say(b)
say(encode.unbase64(b))
say(encode.hex("TB"), encode.unhex("5442"))
say(encode.url("a b&c=d"))
say(encode.rot13("Uryyb, Gnavfun"))
say(round(encode.entropy("aaaaaaaa"), 2), round(encode.entropy("x9$Kq!2zP#w"), 2))Functions
base64(text, encoding?)
returns textThe text in base64. encoding is how the text becomes bytes first: "utf-8" (default) or "utf-16" (what PowerShell's -EncodedCommand uses).
unbase64(text, encoding?)
returns textDecode base64 (normal or URL-safe; missing = padding and spaces are fine). Without encoding it guesses: UTF-16 for PowerShell -EncodedCommand payloads, otherwise UTF-8.
hex(text)
returns textThe text's UTF-8 bytes as hex: hex("hi") is "6869".
unhex(text)
returns textTurn hex back into text. Spaces, colons, \x and 0x prefixes are ignored: unhex("68 69") and unhex("\\x68\\x69") are both "hi".
url(text)
returns textURL-encode text so it is safe inside a link: url("a b&c") is "a%20b%26c".
unurl(text)
returns textDecode URL encoding (%41 and + for space), like a web server does. Run it twice on double-encoded attacks such as %252e%252e%252f.
rot13(text)
returns textShift every letter 13 places (doing it twice gives the text back). Windows hides some registry values this way.
entropy(text)
returns numberHow random the text looks, in bits per character (Shannon entropy): 0 for "aaaa", about 3-4 for English words, 4.5+ for random domains, keys and packed data.