Layered Encoding & the Next Step
What is it?
Obfuscation stacks encodings: Base64 of a gzip of the real payload, or hex of Base64. You peel one layer, read what the output looks like, and let its shape tell you the next operation.
Why it matters
Most real payloads are multi-layered. The skill is not knowing the chain in advance — it is reading each intermediate output and recognising the clue for the next layer (a gzip magic byte, more Base64, readable-but-shifted text).
Where you see it
After From Base64 you see bytes starting 1F 8B (gzip) → add Gunzip; or you see another Base64-looking string → decode again; or shifted letters → try ROT13.
What normal looks like
Each peeled layer reveals a recognisable next-step clue, and the chain terminates in clear plaintext or an indicator.
What suspicious looks like
In your process: applying a random next operation instead of reading the clue, so you thrash instead of converging on the plaintext.
How analysts investigate
After each decode, ask what the output IS: binary with a known magic (gzip/zip), another encoding's alphabet, or shifted text — and pick the operation that clue implies.
Common beginner mistakes
- Ignoring a magic byte (1F 8B = gzip) that names the next operation.
- Trying random operations instead of reading the intermediate clue.
Peel, read the clue, peel again
input → From Base64 → 1F 8B 08 ... ← gzip magic → Gunzip
→ Gunzip → 'JHU9J2h0dHA6Ly8...' ← looks Base64 → From Base64
→ From Base64 → http://evil.example/... ← plaintext! done
the OUTPUT's shape names the next operationQuick check
After From Base64, the output starts with bytes 1F 8B. What next?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.