Essential Guide to Classic Encodings and Ciphers for CTF Challenges

Preface

Many capture‑the‑flag (CTF) brain‑teaser crypto challenges rely on classic, non‑modern ciphers that often apply simple transformations to the ciphertext. This document provides a concise reference for the most frequently encountered encodings and simple ciphers, together with concrete examples and command‑line usage.

Common Encodings

ASCII encoding

Base64 / Base32 / Base16

Shellcode encoding

Quoted‑Printable

XXencode

UUencode

URL encoding

Unicode encoding

Escape/Unescape (%u) encoding

HTML entity encoding

Tap code

Morse code

1. ASCII Encoding

ASCII consists of three parts: non‑printable control characters (0‑31), printable characters used in most CTF tasks, and extended printable characters. The sentence “The quick brown fox jumps over the lazy dog” converted to decimal ASCII values is:

84 104 101 32 113 117 105 99 107 32 98 114 111 119 110 32 102 111 120 32 106 117 109 112 115 32 111 118 101 114 32 116 104 101 32 108 97 122 121 32 100 111 103

These decimal values can be represented in binary, octal, or hexadecimal as needed.

2. Base64 / Base32 / Base16

Base64 groups three 8‑bit bytes into four 6‑bit groups and pads the final group with “=”. The 64 characters used are A‑Z, a‑z, 0‑9, “+”, “/”. Base32 and Base16 work similarly with 5‑bit and 4‑bit groups respectively.

Python’s base64 module can encode and decode all three formats:

import base64
b64 = base64.b64encode(b"text")
print(b64)
print(base64.b64decode(b64))

3. Shellcode Encoding

Shellcode is often represented as escaped hexadecimal bytes. Using the same sample text, the shellcode representation is:

\x54\x68\x65\x7f\x71\x75\x69\x63\x6b\x7f\x62\x72\x6f\x77\x6e\x7f\x66\x6f\x78\x7f\x6a\x75\x6d\x70\x73\x7f\x6f\x76\x65\x72\x7f\x74\x68\x65\x7f\x6c\x61\x7a\x79\x7f\x64\x6f\x67

4. Quoted‑Printable Encoding

Used in MIME email bodies, non‑ASCII bytes are represented as “=XX” where “XX” is the hexadecimal value. Example:

=E6=95=8F=E6=8D=B7=E7=9A=84=E6=A3=95=E8=89=B2=E7=8B=90=E7=8B=B8=E8=B7=B3=E8

Online tools can encode/decode Quoted‑Printable strings. URL: http://www.mxcz.net/tools/QuotedPrintable.aspx

5. XXencode

XXencode processes input in three‑byte blocks, mapping each 6‑bit group to a printable character from the set “+-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz”. Example output for the sample sentence:

hJ4VZ653pOKBf647mPrRi64NjS0-eRKpkQm-jRaJm65FcNG-gMLdt64FjNkc+

Decoding tool: http://web.chacuo.net/charsetxxencode

6. UUencode

UUencode also works on three‑byte blocks but adds 32 to each 6‑bit value to map into the printable ASCII range (32‑95). Example output:

M5&AE('%U:6-K(&)R;W=N(&9O>"!J=6UP<R!O=F5R('1H92!L87IY(&1O9PH*

Decoding tool: http://web.chacuo.net/charsetuuencode

7. URL Encoding

Percent‑encoding replaces each byte with “%” followed by its two‑digit hexadecimal value. Example for the sample sentence:

%54%68%65%20%71%75%69%63%6b%20%62%72%6f%77%6e%20%66%6f%78%20%6a%75%6d%70%73%20%6f%76%65%72%20%74%68%65%20%6c%61%7a%79%20%64%6f%67

Decoding tool: http://web.chacuo.net/charseturlencode

8. Unicode Encoding

Four common representations are shown for the string “The”:

The (hex entity)

The (decimal entity)

\U0054\U0068\U0065 (Python‑style escape)

\U+0054\U+0068\U+0065 (Unicode notation)

Conversion tool: http://www.mxcz.net/tools/Unicode.aspx

9. Escape/Unescape (%u) Encoding

This format prefixes UTF‑16BE hexadecimal values with “%u”. Example for “The”:

%u0054%u0068%u0065

10. HTML Entity Encoding

Standard HTML character references (e.g.,  ) can represent any Unicode character. Full reference list: http://www.w3school.com.cn/tags/html_ref_entities.html

11. Tap Code

Tap code is a 5×5 Polybius square that merges the letter K with C. The grid is:

12. Morse Code

Morse code represents letters, numbers, and punctuation with dots and dashes. The timing elements are dot (.), dash (-), intra‑character gap (space), inter‑word gap (/), and inter‑sentence gap (long pause). A concise alphabet table:

A .-    N -.    . .-.-.-    + .-.-.    1 .----
B -...  O ---   , --..--   _ ..--.-   2 ..---
C -.-.  P .--.  : ---...   $ ...-..-   3 ...--
D -..   Q --.-  " .-..-.   & .-...    4 ....-
E .     R .-.   ' .----.   / -..-.    5 .....
F ..-.  S ...   ! -.-.--   6 -....
G --.   T -     ? ..--..   7 --...
H ....  U ..-   @ .--.-.   8 ---..
I ..    V ...-  - -....-   9 ----.
J .---  W .--   ; -.-.-.   0 -----
K -.-   X -..-  ( -.--.
L .-..  Y -.--  ) -.--.-
M --    Z --..  = -...-

Encoding the sample sentence yields:

- .... . / --.- ..- .. -.-. -.- / -... .-. --- .-- -. / ..-. --- -..- / .--- ..- -- .--. ... / --- ...- . .-. / - .... . / .-.. .- --.. -.-- / -.. --- --.

Online Morse encoder/decoder: http://rumkin.com/tools/cipher/morse.php