Python Web Hacking: PHP XOR | Natas (Level 11)

[Vaso]

If someone wants to do everything in python3:
1. For PHP function "xor_encrypt":
* convert each character in for loop to ascii (I used funcion ord()) then to integer (I used funcion int())
* XOR sign is the same, after XOR operation convert result back to char (I used function chr())
2. For JSON, I assigned to variable JSON structured string
3. For ciphertext:
* urllib in python3 is devided in smaller parts so 'unquote' is in urllib.parse. (urllib.parse.unquote)
* after b64.decode, python3 will show you result represented in bytes, so after b64decode one more decode (.decode('utf-8')) is needed
* to encode goood_ciphertext using base64, first you need str.encode() and then .decode('utf-8')

I think this is all, enjoy!

[matthewbrown]

This is fantastic- I haven't had any experience coding in PHP so this was really helpful and though I have used requests extensively in Flask and Django, its super helpful to see how it works on its own.
I would add that instead of bringing a hexdump of the XOR'd data from python and then decoding hex in PHP, you can simply bring over the cookie value into a variable if you want and then simply base64_decode the cookie value in PHP before running the function.
$cookie =

It keeps everything in PHP and cuts out an unnecessary step.

[sandra]

Funny what I find is that they have a pattern circle I'm glad you have fun with cyber security and I learning as I can but I find digital programming is easier

[norbertliszewski]

This is awesome, im try to repeat on my system, everything its works !!!

[ir]

what's the package you use for running python inside sublime, and do you know is there something similar for atom

[HundleBundle]

I'm fairly new to Python and have been trying to follow along in an effort to learn it a bit better but I'm using python 3 and it seems like there have been a lot of changes.. specifically for natas11 I can't figure out how to get the same output as John at 11:09. I appended ".decode('uft-8')" to the end of my string and was able to get a bit closer but can't seem to go any further... to get the whole xor encoded variable... any help appreciated

[bethe]

help... anyone...
I use sublime text 3....
ctrl + shift + p... I don't see 'Tidy html'...
Now I don't use 'Tidy html' why...?? Let me know it... plz

[TotemYuri]

good video but for the people that have 0 knowledge in scripting, python and e.g... it's very hard and fast..

[mohamed-vvxb]

Could you make a tutorial about telerik fiddler?