BurpSuite Decoder Unwrap for Pentesters (PART-7)

DECODER:INTRODUCTION

Burpsuite decoder option is used to convert encoded data into a simple form or to change data into multiple hashed and encoded formats. It supports a wide range of encoding formats.

Decoding/Encoding/Hash/Smart Decoding

This is a screenshot of the encoding formats’ decoding one, where we provide what we want to decode in the field and can also select the decoding type. We can perform manual decoding by simply selecting the desired one from the drop-down menu, which will be applied to the entire data set.

Encoding

Various transformations can be applied to various elements of the data. There are the following decode and encode operations available:

• URL
• HTML
• Base64
• ASCII hex
• Hex
• Octal
• Binary
• GZIP

In addition, depending on the capabilities of your Java platform, numerous standard hash functions are accessible. When a transformation is done to a portion of the data, the following things take place:

• The altered portion of the data gets colorized appropriately. The colors used can be seen by looking at the manual drop-down lists.
• The outcomes of each transformation that was used are displayed in a brand-new editor. The raw version of any portions of the data that have not been converted is copied into the new panel.

As illustrated here, we will simply enter the data to be encoded into the field and choose the appropriate encoding.

HASHING

As previously demonstrated, the technique of transforming a given key into another value is known as hashing. The new value is produced using a hash function in accordance with a mathematical algorithm. A hash value, or simply a hash, is the output of a hash function.

One-way hashing is the technique used by a decent hash function, which means that the hash cannot be decrypted to reveal the original key.

Users can hash our value, and there aren’t many colors to distinguish between, and hashing is an irreversible procedure.

SMART DECODE

Clients can utilize the smart decoder option button to decode the material in an intelligent manner. Burp will try to decode it in a specific form and make the best approximation based on it in order to recognize specific encoding types. It occasionally makes mistakes or errors. Recursively, this procedure is carried out until no more recognizable data formats are found. When you have found some opaque data and want to quickly check to see whether it can be quickly decoded into a more identifiable form, this option can be a helpful initial step. The customary colorization is used to signify the decoding that is applied to each component of the data.

Loading Data into Encoder/Decoder

Below is a practical demonstration to make your Decoder clearer.

• When we load a key or text in the area there, we can see the option to decode and encode it.

• In this section, we’ll encode the data and see what happens.

• Here we have also shown when we will hash the same procedure of the encoded format.

COMPARER:INTRODUCTION

The Burp comparer is a tool that has fantastic utility. The comparer’s landing page is shown below, and this tool is used to compare two pieces of data. For example, when looking for username criteria, we can compare failed logins with valid and invalid usernames.

When we run intruder attacks and receive a significant response, we use a comparer, which allows us to quickly compare.

Loading Data to compare

We can directly load data into compare as shown below. :-

• Paste it directly from the clipboard
• Load it from a file
• And the one we’re doing is selecting the data within burp and selecting transmit to comparison.
• In this case, we have two requests that may be identical, so we use a comparer to determine the difference.

After sending a request to the comparer , we can now compare them using words or bytes. The most useful option is to search by text, and we usually wish to detect noticeable differences. We may also compare at the byte level.

PERFORMING COMPARISON

Word Compare-Based on whitespace delimiters, this comparison is performed. It is particularly beneficial when the interesting distinctions between the items being compared reside at the word level.

Byte Compare-This comparison identifies the byte-level modifications required to convert the first item to the second.

When we start a comparison, a new window will appear, and we can see one below, as well as inspect each item in text or hex form.

The distinctions are mentioned in the request and reply.

It will also display the highlighted color, indicating if the data was added, updated, or deleted.

Thanks For Visiting,Hope you enjoyed the BurpSuite Decoder Unwrap for Pentesters blog.

In the Next part we are going to learn Further essential Topics of the Burp Suite.