Tuesday, October 19, 2010

Decoding Javascript Hex Encoding

Suppose that a web page has some Javascript that contains some hex encoding like this:
\x74\x65\x73\x74\x69\x6e\x67\x20\x31\x20\x32\x20\x33\x0a
How can we decode this on the command line? TIMTOWTDI, but here's one possible solution:
echo "\x74\x65\x73\x74\x69\x6e\x67\x20\x31\x20\x32\x20\x33\x0a" |sed 's|\\x| |g' |xxd -r -p

This gives us the answer:
testing 1 2 3

So how does it work? "xxd -r -p" converts from hex to ASCII, but it's expecting the hex digits to be space delimited. So we use sed to replace each instance of "\x" with a single space. Note that we have to escape the backslash, hence the "\\x".

NOTE: If you don't already have the xxd utility installed, it can be found in the vim-common package in most Linux distributions.

1 comment:

JeffSoh said...

Good stuff. Glad I found your page.

Search This Blog

Featured Post

Security Onion 2.4.180 now available including new features, updated components, and quality of life improvements!

Security Onion 2.4.180 is now available and includes several new features, updated components, and many quality of life improvements! For Se...

Popular Posts

Blog Archive