base64 strings

[RandomRobbieBF]

Hey,

I was looking to use this for decoding some base64 strings inside json and it did not see to find the following when using refang.

  },
      "data": {
        ".dockerconfigjson": "ewoJImF1dGhzIjogewoJCSJjZGUtZG9ja2VyLXJlZ2lzdHJ5LmVpYy5mdWxsc3RyZWFtLmFpIjogewoJCQkiYXV0aCI6ICJZMlJsTFhKbFoybHpkSEo1T21Oa1pTMXlaV2RwYzNSeWVRPT0iCgkJfQoJfQp9"
      },

Any way to improve this at all?

[cmmorrow]

Hi @RandomRobbieBF, I'll look into this and see what I can do.

[battleoverflow]

I've included a very simple version of this in the next release which does a shallow search within the JSON structure, but for your specific case, you can do something like this:

import json, base64

content = \
"""
[
    {
        "data": {
            ".dockerconfigjson": "ewoJImF1dGhzIjogewoJCSJjZGUtZG9ja2VyLXJlZ2lzdHJ5LmVpYy5mdWxsc3RyZWFtLmFpIjogewoJCQkiYXV0aCI6ICJZMlJsTFhKbFoybHpkSEo1T21Oa1pTMXlaV2RwYzNSeWVRPT0iCgkJfQoJfQp9"
        }
    }
]
"""

def validate_base64(data):
    try:
        if isinstance(data, str):
            base64_bytes = bytes(data, 'ascii')
        elif isinstance(data, bytes):
            base64_bytes = data
        else:
            raise ValueError("Data type should be a string or bytes")
        
        return base64.b64encode(base64.b64decode(base64_bytes)) == base64_bytes
    except Exception:
        return False

base64_db = []

def extract_embedded_base64(data):
    for d in json.loads(data):
        for _, value in d.items():
            if validate_base64(value):
                base64_db.append(base64.b64decode(value).decode("ascii"))
            else:
                for _, value in value.items():
                    if validate_base64(value):
                        base64_db.append(base64.b64decode(value).decode("ascii"))

                    for _, value in json.loads(base64.b64decode(value).decode("ascii")).items():
                        if validate_base64(value):
                            base64_db.append(base64.b64decode(value).decode("ascii"))
                        
                        for _, value in value.items():
                            if validate_base64(value):
                                base64_db.append(base64.b64decode(value).decode("ascii"))
                            
                            for _, value in value.items():
                                if validate_base64(value):
                                    base64_db.append(base64.b64decode(value).decode("ascii"))
    
    # Final decoded value
    return base64_db[1] # Remove the "[1]" to view all values collected

print(extract_embedded_base64(content))

Albeit a bit recursive and repetitive, but it should validate values that are base64 encoded and iterate a few objects within the JSON data structure. This script is specific to your use case, so it may not work perfectly for every condition.

If you'd like to try the iocextract feature in the future, you can use it like this once the new version is out, but this search is a little tamer and less specific:

import iocextract

content = \
"""
[
    {
        "data": "ewoJImF1dGhzIjogewoJCSJjZGUtZG9ja2VyLXJlZ2lzdHJ5LmVpYy5mdWxsc3RyZWFtLmFpIjogewoJCQkiYXV0aCI6ICJZMlJsTFhKbFoybHpkSEo1T21Oa1pTMXlaV2RwYzNSeWVRPT0iCgkJfQoJfQp9"
    }
]
"""

print(list(iocextract.extract_encoded_urls(content, parse_json=True)))