Solving encoding puzzles with CyberChef: base64, hex, ROT13, and stacked layers

Recognize first

Many beginner challenges wrap a flag in several encodings. Base64 uses letters, digits, + and / and often ends with =. Base32 uses uppercase letters and digits 2 to 7 with = padding. Hex uses 0 to 9 and a to f. ROT13 keeps the letter shapes but shifts them, so the format often looks like synt{...} for flag{...}. Binary is groups of 0 and 1; decimal ASCII looks like 102 108 97 103.

CyberChef recipes

CyberChef, from GCHQ, is a browser tool that chains operations into a recipe. You can run it offline by downloading the release. The Magic operation tries common decodings automatically and suggests likely ones, which is helpful when you are unsure. Save useful recipes for reuse.

Lab: peel the layers

Make a practice string by encoding a flag three times, then decode it in CyberChef using From Base64, From Hex, and ROT13 in the correct order. Then do the same in Python so you can automate it when a challenge has dozens of layers.

Snippet

python3 - <<'EOF'
import base64, codecs
flag = 'flag{layers_of_practice}'
step1 = codecs.encode(flag, 'rot13')
step2 = step1.encode().hex()
step3 = base64.b64encode(step2.encode()).decode()
print('challenge:', step3)

decoded = codecs.decode(bytes.fromhex(base64.b64decode(step3).decode()).decode(), 'rot13')
print('solved:', decoded)
EOF

Automating many layers

When a string is base64-encoded fifty times, write a loop that decodes until the result contains the flag format or stops being valid base64. The same idea works for mixed layers if you test each decoding and keep the one that produces printable text.

Snippet

import base64, re
s = open('layers.txt').read().strip()
while not re.search(r'flag\{', s):
    s = base64.b64decode(s).decode()
print(s)

Diagram

Peeling an encoded string

Each layer has a recognizable shape.

base64hexrot13

Layer 3

NzM3OTZlNzQ2NzdiNzk...

Letters, digits, maybe =

Layer 2

73796e74677b79...

Only 0-9 and a-f

Layer 1

synt{ynlref_bs_cenpgvpr}

Letter shapes of a flag

Check yourself

1. A string uses only 0-9 and a-f. What is it most likely?

2. A string looks like synt{...}. Which decoding is likely?

3. Which CyberChef operation tries common decodings automatically?