{"id":17348019,"url":"https://github.com/jelchison/check-enc","last_synced_at":"2025-03-27T11:22:06.138Z","repository":{"id":80501221,"uuid":"99938414","full_name":"JElchison/check-enc","owner":"JElchison","description":"Python script that uses character frequency analysis to determine likely encodings of opaque files.  Can be useful in CTF competitions.","archived":false,"fork":false,"pushed_at":"2022-05-21T20:24:28.000Z","size":19,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-02-01T15:45:56.700Z","etag":null,"topics":["ctf","encodings","frequency-analysis","python"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/JElchison.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-08-10T15:32:33.000Z","updated_at":"2022-05-21T20:24:31.000Z","dependencies_parsed_at":null,"dependency_job_id":"ff1191e3-78b1-4d75-8fd0-98b72f3d00ca","html_url":"https://github.com/JElchison/check-enc","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JElchison%2Fcheck-enc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JElchison%2Fcheck-enc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JElchison%2Fcheck-enc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JElchison%2Fcheck-enc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/JElchison","download_url":"https://codeload.github.com/JElchison/check-enc/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245832746,"owners_count":20679704,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ctf","encodings","frequency-analysis","python"],"created_at":"2024-10-15T16:50:51.226Z","updated_at":"2025-03-27T11:22:06.133Z","avatar_url":"https://github.com/JElchison.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# check-enc\n\nPython script that uses character frequency analysis to determine likely encodings of opaque files.  Can be useful in CTF competitions.\n\n\n# Features\n* Attempts the following encodings:\n    * hex_codec\n    * base64_codec\n    * rot_13\n    * utf_8\n    * utf_16_be\n    * utf_16_le\n    * bz2\n    * zip\n    * idna\n    * palmos\n    * punycode\n    * quopri_codec\n    * utf_7\n    * base32\n    * uuencode\n    * quotable\n    * binhex4\n    * yenc\n* Attempts permutations of any 2 of the above-listed enodings\n\n\n# Prerequisites\nTo install necessary prerequisites on Ubuntu:\n\n    sudo apt-get install python3-yenc\n\n\n# Usage\n```\nPurpose:  Attempts to decode/encode unknown data\n\nPrereq:   Python package 'yenc'.  On Debian systems, this can be installed\n          using `sudo apt-get install python-yenc`\n\nUsage:    checkenc.py [-d|-e] [-1] [-a] [-v] -f \u003cfile\u003e\n              reads data from file\n          checkenc.py [-d|-e] [-1] [-a] [-v] '\u003cdata\u003e'\n              reads data from last non-option argument\n          checkenc.py -h\n              displays this help\n\nOptions:  -d  Decode data (default)\n\n          -e  Encode data (if absent, -d is assumed)\n          \n          -1  Only performs one decoding/encoding pass on data (if absent,\n              default behavior is to attempt all permutations of any two\n              encodings).  This will decrease running time for large data\n              sets.\n          \n          -a  Display all results (if absent, only top 20 are displayed)\n          \n          -v  Verbose mode\n          \nOutput:   One row is displayed for each result.  There are three columns in\n          each row:\n              1)  Score.  higher (more positive) is better.  The score will\n                  usually be negative.\n              2)  Encoding used (or combination of encodings).  \"Caesar_XXX\"\n                  is a Caesar cipher with each byte incremented by XXX.\n              3)  Result after de/encoding.  Special characters will be escaped\n                  appropriately.\n```\n\n\n### Example usage\nOn Ubuntu:\n```\nuser@computer:~$ ./checkenc.py -f base64.bin \nFirst pass complete.  Now trying permutating each result...\nTop 20 results, worst to best:\n-644.75 \u003cbase64_codec + quotable\u003e \"'ThisIsATest\\\\n'\"\n-603.41 \u003cutf_8\u003e u'VGhpc0lzQVRlc3QK\\n'\n-603.41 \u003cidna\u003e u'VGhpc0lzQVRlc3QK\\n'\n-603.41 \u003cpalmos\u003e u'VGhpc0lzQVRlc3QK\\n'\n-603.41 \u003cutf_7\u003e u'VGhpc0lzQVRlc3QK\\n'\n-597.33 \u003cquopri_codec\u003e 'VGhpc0lzQVRlc3QK\\n'\n-597.33 \u003cquotable\u003e 'VGhpc0lzQVRlc3QK\\n'\n-590.33 \u003crot_13\u003e u'ITucp0ymDIEyp3DX\\n'\n-585.33 \u003cCaesar_255\u003e 'UFgob/kyPUQkb2PJ\\t'\n-584.38 \u003cbase64_codec + Caesar_4\u003e '+XlmwMwEXiwx`r+'\n-582.37 \u003cbase64_codec + Caesar_254\u003e '%RfgqGq?RcqrZl%'\n-577.70 \u003cbase64_codec + Caesar_2\u003e ')VjkuKuCVguv^p)'\n-576.05 \u003cbase64_codec + Caesar_253\u003e '$QefpFp\u003eQbpqYk$'\n-569.52 \u003cbase64_codec + Caesar_3\u003e '*WklvLvDWhvw_q*'\n-569.10 \u003cbase64_codec + Caesar_252\u003e '#PdeoEo=PaopXj#'\n-557.71 \u003cbase64_codec + Caesar_1\u003e '(UijtJtBUftu]o('\n-494.86 \u003cbase64_codec + Caesar_5\u003e ',YmnxNxFYjxyas,'\n-483.99 \u003cbase64_codec + Caesar_6\u003e '-ZnoyOyGZkyzbt-'\n-344.75 \u003cbase64_codec\u003e 'ThisIsATest\\n'\n\nuser@computer:~$ ./checkenc.py -f base64_plus_caesar.bin \nFirst pass complete.  Now trying permutating each result...\nTop 20 results, worst to best:\n-671.46 \u003cCaesar_246\u003e \"M\u003e_gZ'cqHMIcZ*HB\"\n-662.67 \u003cCaesar_249\u003e 'PAbj]*ftKPLf]-KE'\n-662.13 \u003cCaesar_251\u003e 'RCdl_,hvMRNh_/MG'\n-659.41 \u003cCaesar_245\u003e 'L=^fY\u0026bpGLHbY)GA'\n-653.25 \u003cCaesar_252\u003e 'SDem`-iwNSOi`0NH'\n-601.57 \u003crot_13\u003e u'JUvdq1z{EJFzq4EY'\n-582.36 \u003cCaesar_1\u003e 'XIjre2n|SXTne5SM'\n-582.33 \u003cCaesar_3\u003e 'ZKltg4p~UZVpg7UO'\n-571.06 \u003cutf_8\u003e u'WHiqd1m{RWSmd4RL'\n-571.06 \u003cidna\u003e u'WHiqd1m{RWSmd4RL'\n-571.06 \u003cpalmos\u003e u'WHiqd1m{RWSmd4RL'\n-571.06 \u003cutf_7\u003e u'WHiqd1m{RWSmd4RL'\n-564.99 \u003cquopri_codec\u003e 'WHiqd1m{RWSmd4RL'\n-564.99 \u003cquotable\u003e 'WHiqd1m{RWSmd4RL'\n-564.16 \u003cCaesar_2\u003e 'YJksf3o}TYUof6TN'\n-491.93 \u003cCaesar_255\u003e 'VGhpc0lzQVRlc3QK'\n-482.75 \u003cCaesar_254\u003e 'UFgob/kyPUQkb2PJ'\n-473.34 \u003cCaesar_253\u003e 'TEfna.jxOTPja1OI'\n-344.75 \u003cCaesar_255 + base64_codec\u003e 'ThisIsATest\\n'\n```\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjelchison%2Fcheck-enc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjelchison%2Fcheck-enc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjelchison%2Fcheck-enc/lists"}