# 编码解码
English: Encoding/Decoding
- Tool Count: 6
- Use this file to choose the right tool quickly, then open the linked source markdown for full command details.
## Base64编码
- ID: base64-encode
- Command Count: 3
- Original Extracted Source: original extracted tools-wiki source/base64-encode.md
Description:
Base64编码/解码命令集合
Representative Commands:
- 编码: `# Linux:
echo -n "payload" | base64
base64 file.txt > encoded.txt

# Windows PowerShell:
[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("payload"))

# Python:
python3 -c "import base64; print(base64.b64encode(b'payload').decode())"`
- 解码: `# Linux:
echo "cGF5bG9hZA==" | base64 -d
base64 -d encoded.txt > decoded.txt

# Windows PowerShell:
[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("cGF5bG9hZA=="))

# Python:
python3 -c "import base64; print(base64.b64decode('cGF5bG9hZA==').decode())"`
- URL安全Base64: `# Python:
import base64
base64.urlsafe_b64encode(b"payload").decode()
base64.urlsafe_b64decode("cGF5bG9hZA==").decode()`
## URL编码
- ID: url-encode
- Command Count: 2
- Original Extracted Source: original extracted tools-wiki source/url-encode.md
Description:
URL编码/解码命令集合
Representative Commands:
- 编码: `# Python:
python3 -c "from urllib.parse import quote; print(quote('<script>alert(1)</script>'))"

# 双重编码:
python3 -c "from urllib.parse import quote; print(quote(quote('<script>alert(1)</script>')))"

# CyberChef在线: https://gchq.github.io/CyberChef/`
- 解码: `# Python:
python3 -c "from urllib.parse import unquote; print(unquote('%3Cscript%3Ealert(1)%3C%2Fscript%3E'))"

# Linux:
printf '%b' "\x3Cscript\x3E"`
## Hex编码
- ID: hex-encode
- Command Count: 3
- Original Extracted Source: original extracted tools-wiki source/hex-encode.md
Description:
十六进制编码/解码命令集合
Representative Commands:
- 编码: `# Linux:
echo -n "payload" | xxd -p
echo -n "payload" | od -A n -t x1 | tr -d " \n"

# Python:
python3 -c "print('payload'.encode().hex())"
python3 -c "print('\\x'.join([hex(ord(c))[2:] for c in 'payload']))"`
- 解码: `# Linux:
echo "7061796c6f6164" | xxd -r -p

# Python:
python3 -c "print(bytes.fromhex('7061796c6f6164').decode())"`
- Hex转义: `# SQL注入中使用:
SELECT 0x61646D696E  -- "admin"

# XSS中使用:
<img src=x onerror=\x61\x6c\x65\x72\x74(1)>`
## HTML编码
- ID: html-encode
- Command Count: 3
- Original Extracted Source: original extracted tools-wiki source/html-encode.md
Description:
HTML实体编码/解码命令集合
Representative Commands:
- 编码: `# Python:
python3 -c "import html; print(html.escape('<script>alert(1)</script>'))"

# 数字编码:
python3 -c "print(''.join(['&#'+str(ord(c))+';' for c in '<script>alert(1)</script>']))"

# 十六进制HTML编码:
python3 -c "print(''.join(['&#x'+hex(ord(c))[2:]+';' for c in 'alert']))"`
- 解码: `# Python:
python3 -c "import html; print(html.unescape('&lt;script&gt;alert(1)&lt;/script&gt;'))"`
- 常用实体: `# 常用HTML实体:
# < => &lt; 或 &#60; 或 &#x3c;
# > => &gt; 或 &#62; 或 &#x3e;
# " => &quot; 或 &#34; 或 &#x22;
# ' => &apos; 或 &#39; 或 &#x27;
# & => &amp; 或 &#38; 或 &#x26;`
## Unicode编码
- ID: unicode-encode
- Command Count: 3
- Original Extracted Source: original extracted tools-wiki source/unicode-encode.md
Description:
Unicode编码/解码命令集合
Representative Commands:
- 编码: `# Python Unicode转义:
python3 -c "print(''.join(['\\u'+hex(ord(c))[2:].zfill(4) for c in 'alert']))"
# 输出: \u0061\u006c\u0065\u0072\u0074

# UTF-8字节:
python3 -c "print('alert'.encode('utf-8'))"`
- 解码: `# Python:
python3 -c "print('\\u0061\\u006c\\u0065\\u0072\\u0074'.encode().decode('unicode_escape'))"

# JavaScript:
console.log("\u0061\u006c\u0065\u0072\u0074")`
- WAF绕过用法: `# JavaScript Unicode绕过:
<script>\u0061\u006c\u0065\u0072\u0074(1)</script>

# Overlong UTF-8编码:
# / => %c0%af (可绕过路径过滤)
# . => %c0%ae`
## JWT解码
- ID: jwt-decode
- Command Count: 3
- Original Extracted Source: original extracted tools-wiki source/jwt-decode.md
Description:
JWT(JSON Web Token)解码和分析工具
Representative Commands:
- 在线解码: `# 在线工具:
# https://jwt.io
# https://token.dev
# 粘贴JWT即可查看Header和Payload`
- 命令行解码: `# Python:
python3 -c "
import base64, json, sys
token = sys.argv[1]
parts = token.split('.')
for i, part in enumerate(parts[:2]):
    padded = part + '=' * (4 - len(part) % 4)
    decoded = base64.urlsafe_b64decode(padded)
    print(json.dumps(json.loads(decoded), indent=2))
" YOUR_JWT_HERE`
- 结构分析: `# JWT结构: Header.Payload.Signature
# Header: {"alg":"HS256","typ":"JWT"}
# Payload: {"sub":"1234","name":"user","iat":1516239022}
# Signature: HMACSHA256(base64url(header)+"."+base64url(payload), secret)

# 检查要点:
# 1. alg是否可改为none
# 2. 密钥是否为弱密码
# 3. 是否可将RS256改为HS256
# 4. exp是否已过期`
External References:
- https://jwt.io

