Tuesday, October 19, 2010

Decoding Javascript Hex Encoding

Suppose that a web page has some Javascript that contains some hex encoding like this:
\x74\x65\x73\x74\x69\x6e\x67\x20\x31\x20\x32\x20\x33\x0a
How can we decode this on the command line? TIMTOWTDI, but here's one possible solution:
echo "\x74\x65\x73\x74\x69\x6e\x67\x20\x31\x20\x32\x20\x33\x0a" |sed 's|\\x| |g' |xxd -r -p

This gives us the answer:
testing 1 2 3

So how does it work? "xxd -r -p" converts from hex to ASCII, but it's expecting the hex digits to be space delimited. So we use sed to replace each instance of "\x" with a single space. Note that we have to escape the backslash, hence the "\\x".

NOTE: If you don't already have the xxd utility installed, it can be found in the vim-common package in most Linux distributions.

1 comment:

JeffSoh said...

Good stuff. Glad I found your page.

Search This Blog

Featured Post

Security Onion 2.4.130 now available including Elastic 8.17.3 and much more!

Security Onion 2.4.130 is now available including Elastic 8.17.3 and much more! Elastic 8.17.3 The main focus of this release is upgrading t...

Popular Posts

Blog Archive