I’ve been messing with pcre and the from_base64 transform. I’m trying to decode from a json response which contains a literal \n separated base64 block. The issue is if I use mode rfc4648, it will end the string after the first \n encountered as \ is a non base64 alphabet, resulting in a partial output.
Sample payload:
VGhpcyBpcyBhIHNhbXBsZSBibG9jayBvZiBiYXNlNjQgZGF0YSBzZXBhcmF0\nZWQgYnkgbGl0ZXJhbCBcbiBjaGFyYWN0ZXJzIGV2ZXJ5IDYwIGNoYXJhY3Rl\ncnMu
If I use rfc2045, it is supposed to decode line breaks but the problem is my response contains literal \n (2 bytes for the characters \ and n in text) instead of an actual newline character. If I try to use the base64_* buffers instead, that too will end the match after first \n is encountered. Any ideas on decoding this kind of payload?
I’ve also tried running a replace transform before passing to the from_base64 transform which doesn’t work:
http.response_body; pcre:"/<my regex selecting the entire base64 block separated by literal newline chars>/"; replace:"\\n",""; from_base64: mode rfc2045; content:"sample";
The docs mention the replacement should be same length, so I also tried replace:"\\n"," "; (2 spaces) to no avail.