Question 1

Why do attackers encode their payloads?

Accepted Answer

Attackers use encoding and obfuscation to bypass security controls such as web application firewalls (WAFs), intrusion detection systems (IDS), and input validation filters. By layering multiple encodings — Base64, URL encoding, hex, Unicode, and XOR — they disguise malicious commands so they pass through filters that look for known attack patterns, while the target application still decodes and executes them.

Question 2

What encoding types are commonly used in attack payloads?

Accepted Answer

Common encodings include Base64 (converts binary to ASCII), URL encoding (percent-encoding special characters), hex encoding (representing bytes as hexadecimal), HTML entity encoding, Unicode escaping, and XOR with a key. Attackers often chain these — for example, a SQL injection payload might be Base64-encoded, then URL-encoded, requiring defenders to decode multiple layers to identify the attack.

Decode The Payload

How to play

Frequently Asked Questions