Tuesday, October 19, 2010

Decoding Javascript Hex Encoding

Suppose that a web page has some Javascript that contains some hex encoding like this:
\x74\x65\x73\x74\x69\x6e\x67\x20\x31\x20\x32\x20\x33\x0a
How can we decode this on the command line? TIMTOWTDI, but here's one possible solution:
echo "\x74\x65\x73\x74\x69\x6e\x67\x20\x31\x20\x32\x20\x33\x0a" |sed 's|\\x| |g' |xxd -r -p

This gives us the answer:
testing 1 2 3

So how does it work? "xxd -r -p" converts from hex to ASCII, but it's expecting the hex digits to be space delimited. So we use sed to replace each instance of "\x" with a single space. Note that we have to escape the backslash, hence the "\\x".

NOTE: If you don't already have the xxd utility installed, it can be found in the vim-common package in most Linux distributions.

1 comment:

JeffSoh said...

Good stuff. Glad I found your page.

Search This Blog

Featured Post

Security Onion 2.4.111 now available!

In October, we released version 2.4.110: https://blog.securityonion.net/2024/10/security-onion-24110-hurricane-helene.html Last week, Surica...

Popular Posts

Blog Archive