Cybersecurity-Projects/README.md at 9205d3ce4da0f6a1ee1a56677b9ff66c986a2be2

3.3 KiB

Raw Blame History

 ██████╗  ██████╗ ██╗  ██╗████████╗ ██████╗  ██████╗ ██╗
 ██╔══██╗██╔════╝ ██║  ██║╚══██╔══╝██╔═══██╗██╔═══██╗██║
 ██████╔╝███████╗ ███████║   ██║   ██║   ██║██║   ██║██║
 ██╔══██╗██╔═══██╗╚════██║   ██║   ██║   ██║██║   ██║██║
 ██████╔╝╚██████╔╝     ██║   ██║   ╚██████╔╝╚██████╔╝███████╗
 ╚═════╝  ╚═════╝      ╚═╝   ╚═╝    ╚═════╝  ╚═════╝ ╚══════╝

Multi format encoding/decoding CLI with recursive layer detection for security analysis.

Features

Encode/Decode across Base64, Base64URL, Base32, Hex, and URL encoding formats
Auto-detect encoding format with confidence scoring
Peel recursively through multi-layered encoding (the kind attackers use to evade WAFs and IDS)
Chain multiple encoding steps together for testing obfuscation patterns
Pipeline-friendly output for integration into security workflows

Quick Start

uv sync
uv run b64tool encode "Hello World"
uv run b64tool decode "SGVsbG8gV29ybGQ="
uv run b64tool detect "SGVsbG8gV29ybGQ="
uv run b64tool peel "NjQ0ODY1NmM2YzZmMjA1NzZmNzI2YzY0"
uv run b64tool chain "secret" --steps base64,hex,url

Installation

uv sync --all-extras

Usage

Encode

b64tool encode "Hello World"                        # Base64 (default)
b64tool encode "Hello World" --format hex            # Hex
b64tool encode "Hello World" --format base32         # Base32
b64tool encode "hello world&foo=bar" --format url    # URL encoding
echo "piped input" | b64tool encode                  # Stdin
b64tool encode --file secret.txt                     # File input

Decode

b64tool decode "SGVsbG8gV29ybGQ="                   # Base64 (default)
b64tool decode "48656c6c6f" --format hex             # Hex
b64tool decode "JBSWY3DP" --format base32            # Base32

Detect

Identifies the encoding format with confidence scoring:

b64tool detect "SGVsbG8gV29ybGQ="

Peel (Recursive Layer Detection)

The signature feature. Automatically peels back multiple encoding layers, the way real malware and attack payloads obfuscate data:

b64tool peel "NjQ0ODY1NmM2YzZmMjA1NzZmNzI2YzY0"

Chain

Build multi-layered encodings for testing WAF rules, IDS signatures, or understanding obfuscation:

b64tool chain "alert('xss')" --steps base64,hex,url

Security Context

Encoding layering is a real attack technique:

WAF Bypass: Double-encoding payloads to slip past web application firewalls (OWASP)
Malware Obfuscation: DARKGATE malware uses custom Base64 alphabets with randomized shuffling
Data Exfiltration: Base64-encoded data hidden in DNS queries and HTTP headers
IDS Evasion: Multi-layer encoding to avoid signature-based detection

This tool helps security professionals analyze and understand these patterns.

License

MIT

3.3 KiB Raw Blame History