Burp Suite: Other Modules

This guide contains the answer and steps necessary to get to them for the Burp Suite: Other Modules room.

Table of contents

• Decoder: Overview
• Decoder: Encoding/Decoding
• Decoder: Hashing
• Sequencer: Overview
• Sequencer: Live Capture
• Organizer: Overview

Decoder: Overview

1. Which feature attempts auto-decode of the input?

This is the button on the bottom of the page.

Click for answer

Smart Decode

Decoder: Encoding/Decoding

Base64 encode the phrase: Let's Start Simple.

1. What is the base64 encoded version of this text?

Use encode as base64.

Click for answer

TGV0J3MgU3RhcnQgU2ltcGxl

URL Decode this data: %4e%65%78%74%3a%20%44%65%63%6f%64%69%6e%67.

1. What is the plaintext returned?

Use decode as URL.

Click for answer

Next: Decoding

Use Smart decode to decode this data: %34%37.

1. What is the decoded text?

Click the smart decode button.

Click for answer

47

Encode this phrase: Encoding Challenge.

Start with base64 encoding. Take the output of this and convert it into ASCII Hex. Finally, encode the hex string into octal.

1. What is the final string?

First use encode as base64, then encode as ASCII hex, and finally use encode as octal.

Click for answer

24034214a720270024142d541357471232250253552c1162d1206c

Decoder: Hashing

Using Decoder, what is the SHA-256 hashsum of the phrase: Let's get Hashing!?

1. Convert this into an ASCII Hex string for the answer to this question.

First we select the SHA-256 hash. Then we encode the output as ASCII hex.

Click for answer

6b72350e719a8ef5af560830164b13596cb582757437e21d1879502072238abe

Generate an MD4 hashsum of the phrase: Insecure Algorithms.

1. Encode this as base64 (not ASCII Hex) before submitting.

Click for answer

TcV4QGZZN7y7lwYFRMMoeA==

Let's look at an in-context example:

First, download the file attached to this task.

Note: This file can also be downloaded from the deployed VM with wget http://MACHINE_IP:9999/AlteredKeys.zip — you may find this helpful if you are using the AttackBox.

Now read the problem specification below:

"Some joker has messed with my SSH key! There are four keys in the directory, and I have no idea which is the real one. The MD5 hashsum for my key is 3166226048d6ad776370dc105d40d9f8 — could you find it for me?"

1. What is the correct key name?

After hashing the key files, we get on hash that is the same as the provided hash.

Click for answer

key3

Sequencer: Overview

1. What does Sequencer allow us to evaluate?

This answers can be found in the text.

Click for answer

Entropy

Sequencer: Live Capture

1. What is the overall quality of randomness estimated to be?

Make sure you capture the request of the webpage itself, not the login attempt. Send the request to sequencer and select the token form field.

Start the live capture and wait until you have around 10000 tokens before performing the analysis.

Click for answer

Excellent

Organizer: Overview

1. Are saved requests read-only? (yea/nay)

The answer can be found in the text.

Click for answer

yea