3

I am working on a project where I am getting parts of base64 encoded data, but not the whole thing. Is it possible to figure out what that part of the base64 encoded data was?

For example. Say I base64 encode hello world

It becomes aGVsbG8gd29ybGQ=

But say I am only able to capture sbG8gd29y

Which base4 decodes to ݽ

I am familiar with how base64 encoding process works and I cannot think of a way to figure out what part of a base64 encoded message is without adding data randomly to the chunk on the front and back and comparing with dictionary words, but the problem is I am not even 100% sure that the data I am working with includes dictionary words.

Thanks

MikeSchem
  • 950
  • 2
  • 16
  • 29

1 Answers1

6

I just spent a little time using an online conveter (http://www.convertstring.com/EncodeDecode/Base64Decode) If you take your captured section you can run it through the converter and see that its an invalid length for a base64 encoded string.

For a captured section to have a valid length you will need to add some extra characters (0-3 depending on the length of the section). A valid base64 string has a length that is exactly devisible by 4.

Pick a character ('a' for example) and then run through the posibilities of adding the correct amount of characters to the section, front and back. With your added characters the string will be decodable and one of the decoded values will be more readable, that will be the one that has the partially decoded data.

E.G:

   sbG8gd29yaaa
and
   aaasbG8gd29y

decodes to:

   ����ݽɦ�
and
   i��lo wor

You can make a rudimentary programatic test for readability by counting the number of 'normal' characters within the string (a-z for example). You will need to make up your own mind what is 'normal', it will depend on the expected language of the data and the context (is it known to be numeric only for example).

Mark W
  • 705
  • 1
  • 9
  • 20