Unit 1: Encoding, hashing and encryption · Lesson 1 of 5 · 18 min
It says encrypted. Is it?
Check a config value a developer labelled as encrypted, and prove what it really is.
mission
- You are
- You are the new security engineer at Fernhill Logistics.
- Situation
- A developer wants to commit
app.confto a public repository. The comment in the file says the secret is encrypted and safe to share. - Goal
- Decide whether the value is protected and show the team the evidence.
- Hand in
- The decoded value and a one-line recommendation.
Three machines that are easy to confuse
Read the file
Start with the evidence, not the comment. Look at the value itself.
cat app.conf
[reports]
host = reports.fernhill.example
user = svc_reports
secret = ZmVybmhpbGwtcmVwb3J0cy1wcm9k
note = the secret above is encrypted, safe to share
you should see A value made only of letters, digits and maybe +, / or = at the end.
cat- Prints the contents of one or more files. Built into Linux and macOS.
Recognise the alphabet
Base64 uses 64 characters and pads with =. Real ciphertext is binary and usually looks like garbage or arrives as base64 of random bytes, which is longer and has no readable shape when decoded.
awk '/^secret/ {print $3}' app.conf ZmVybmhpbGwtcmVwb3J0cy1wcm9k awk '/^secret/ {print $3}' app.conf | wc -c 29
you should see 28 characters plus the newline. A length that is a multiple of 4 is another base64 hint.
awk- Splits each line into fields and prints or counts the ones you ask for. Built into Linux and macOS.
wc- Counts lines, words and bytes. Built into Linux and macOS.
Decode it
Decoding needs no key. If you can do it in one command, so can anyone who reads the repository.
awk '/^secret/ {print $3}' app.conf | base64 -d; echo
fernhill-reports-prod
you should see A readable production secret.
defender tip Search repositories and tickets for long base64 strings during reviews. grep -rEo '[A-Za-z0-9+/]{20,}={0,2}' finds candidates fast.
base64- Encodes data as base64 text, or decodes it with -d. Built into Linux and macOS.
echo- Prints its arguments. Built into Linux and macOS.
Show the round trip
Encode the plain value yourself. Getting the same string back proves there is no key and no secret involved.
printf 'fernhill-reports-prod' | base64
ZmVybmhpbGwtcmVwb3J0cy1wcm9k
defender tip Use printf or echo -n. A plain echo adds a newline, which changes the output.
printf- Prints formatted text. Built into Linux and macOS.
What the fix looks like
[reports] user = svc_reports secret = ZmVybmhpbGwtcmVwb3J0cy1wcm9k
Anyone with the file has the secret.
[reports] user = svc_reports secret_ref = vault:kv/reports/prod
The file names where the secret lives. Rotate the old value, since it was exposed.
What a defender takes away
- 1Encoding changes the format, not who can read it.
- 2If no key is needed to reverse it, it is not encryption.
- 3Treat any exposed secret as compromised and rotate it.
- 4Secrets belong in a secret store, not in config files.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.