Lampwrights Forum - Finding Base64 Encoded Exploits

Lampwrights Forum (http://www.lampwrights.com/index.php)

- A Secure Web (http://www.lampwrights.com/forumdisplay.php?f=8)

- - Finding Base64 Encoded Exploits (http://www.lampwrights.com/showthread.php?t=28)

Finding Base64 Encoded Exploits

When a PHP application is hacked and serving content that you cannot seem to find, chances are it is encoded in base64 and somewhere being decoded and displayed. Hackers will obfuscate this code making it hard to find. One way to find this code is to disable the base64_decode function in your php.ini file:

Code:

disable_function = "base64_decode"

Restart Apache and watch your error log to see where error messages pop up and this may allow you to see where the code is executing. Knowing where it executes is a great leap into finding HOW it is executing.

If none of your applications use base64_decode, then feel free to leave it disabled in php.ini. It will save you a lot of headaches in the future anyway.

With “hacking” being a household word for anyone using computers, this is a fantastic method to find the encoded base64 which the hackers would have hidden somewhere when they did the mischief and if none of your applications use the base_64 decode the be smart and leave it disabled in php.ini as it'll save you a lot of trouble later!!

Flipnote Studio DSi private key, in .pem format:

Code:

This is the Flipnote Studio DSi signing key in pem format

Have you encountered situations where disabling the base64_decode function in php.ini helped in identifying and mitigating encoded base64 exploits effectively?

Have you ever faced scenarios where disabling the base64_decode function in php.ini proved helpful in pinpointing and mitigating encoded base64 exploits effectively?

Finding Base64 Encoded Exploits

You can disable the base64_decode function in the php.ini file can indeed provide valuable insights into identifying potential security breaches within a PHP application. But be careful, that should not be utilized by any of your applications. I think it is a proactive step towards enhancing security.