tomnomnom/gf

grep base64 output is wrong

z0x0z opened this issue · 1 comments

z0x0z commented

Below is the content in my file.
there is a JWT token which is base64 encoded.

Cache-Control: max-age=0
< Set-Cookie: _ua={"session_id":"b24a5ce4-bd5a-4375-99a5-c5eb78c524c9","session_time_ms":1585593146162}; path=/; httponly
< Set-Cookie: jwt-session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkYXRhIjp7ImNzcmYtc2VjcmV0Ijoi77-9Tlxu77-9VSrvv71cdTAwMTNcdTAwMDfvv71T77-977-977-977-9XHUwMDEx77-9XHUwMDEx77-9Rlx1MDAxMu-_ve-_vSDvv70877-977-9McmiMSJ9LCJpYXQiOjE1ODU1OTMxNDYsImV4cCI6MTU4NTY3OTU0Nn0.Wkn8UFPcVJIk0pV1jQI8YqeI2FJstbpXq2UMa7B0tDU; path=/; expires=Tue, 31 Mar 2020 18:32:26 GMT; httponly
< X-Content-Type-Options: nosniff

image

when I use gf, it shows only half of the base64 encoded output. that is if there is any ' - ' in base64 format then gf regex stops there and outputs until that.

Is that a bug or expected result?
Any help is appreciated!

JWT are URL safe base64 + dots, you can add this format (didn't test it) for them.


{
    "flags": "-HnroE",
    "pattern": "eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+={0,2}"
}