Tools · Web testing tools · 07 / 23
Decoder, and the encodings it does not break
Decoder turns URL encoding and ordinary base64 back into text you can read. It does not open TLS, it does not reverse a password hash, and a readable label is not a session you are allowed to edit.
URL encoding is a spelling rule
Harbor Ledger’s “return to this invoice” link carries a query parameter named next. The value is the path the app will send the browser to after sign-in, written with percent-encoding so the slashes survive the query string. In the history row it looks like next=%2Finvoices%2F1042. Paste that value into Decoder and URL-decode it. The text becomes /invoices/1042.
That is the entire mystery. You decode it so the note can name the path in characters a reader understands. You do not need a second tool, and you do not need to send a modified next value anywhere. If you are checking how the app uses next, the authorized observation is the one the history already shows: the parameter’s decoded form is a path on the lab.
Encoded: next=%2Finvoices%2F1042 Decoded: next=/invoices/1042 Encoded label: SGFyYm9yIExlZGdlcg== Decoded label: Harbor Ledger
Base64 is an alphabet
The same lab stamps a short base64 label into a footer comment in the HTML: SGFyYm9yIExlZGdlcg==. Decoder’s base64 decode shows Harbor Ledger. Nothing was protected. Base64 exists so binary, or text with awkward characters, can travel through places that want a safe alphabet. Treating the footer as a secret because it looks noisy is a misread of the alphabet.
Decode one layer, look at the result, and stop when you have text. “Smart decode” will try several alphabets for you. On a short string it can land on a plausible wrong answer. Prefer the encoding you can name from the app, which here is base64 of a label and URL encoding of a path.
What stays opaque
A password hash stored for the lab’s seed accounts does not decode into a password. There is no dropdown that reverses it, and this course does not turn Decoder into a guessing exercise. If the hash is sitting in a file the lab told you to review, the useful sentence is that the file is readable and the hash is in it. The control is to keep that file out of the project notes you paste around, and to store real passwords with a slow hash in an app you run for anyone but yourself.
TLS is the other hard stop. Traffic you see in clear text inside Burp is clear because the lab browser trusted the proxy, or because the lab is plain HTTP on loopback. Decoder did not “break HTTPS.” On a host you do not run, you will not see the body, and you should not be pointed at that host.
Worked case: decode the return path and the footer
From history, copy only the next parameter’s value into Decoder. URL-decode it and confirm the path is /invoices/1042. Then copy the footer label and base64-decode it. Confirm the words Harbor Ledger. Write both pairs, encoded and decoded, in the note.
Then pick one thing you will not feed the tool: the session cookie, a hash from the seed file, or a response from any host but the lab. The cookie is a secret that is already stored in the project. Decoding it would not explain it. The discipline is knowing which alphabet you are looking at before you ask the tool to translate.
Diagram
An encoding is not a protection you can peel forever
- URL encoding
A query value such as %2Finvoices%2F1042 is the path /invoices/1042 written so it can sit in a query string.
- Base64
SGFyYm9yIExlZGdlcg== is the label Harbor Ledger. Anyone can decode it because it was never a secret.
- A hash
A password hash does not decode to the password. Decoder has nothing to invert.
- A signature
A readable middle segment of a token is still not a checked signature. Reading it is not permission to send a modified copy.
What Decoder can show you
- URL encoding
Percent-encoding hides reserved characters. Decoding %2F shows a slash. The result is text the lab already put in a link.
- Base64 text
Base64 is an alphabet for bytes. The lab’s display label decodes to Harbor Ledger. There is no key because there was no encryption.
- A hash or TLS
A hash is one way. TLS is a session with keys Decoder never sees. Both stay opaque, and that is the correct result.
URL-encoded path %2Finvoices%2F1042 decodes to /invoices/1042 Base64 label SGFyYm9yIExlZGdlcg== decodes to Harbor Ledger Not a Decoder job a password hash the TLS session to a host you do not run
Check yourself
1. The lab redirects through the query value next=%2Finvoices%2F1042. What does Decoder’s URL decode show?
2. SGFyYm9yIExlZGdlcg== decodes to the words Harbor Ledger. What did you learn about the label?
3. You find a password hash in a lab config you were told to review. What can Decoder add?