Bandit 10 → 11: base64 is not a lock

The shortest level in a while. The whole thing is recognising a format on sight and knowing the flag that reverses it.

the goal

The password for the next level is stored in the file data.txt, which contains base64 encoded data.

the approach

bandit10@bandit:~$ ls
data.txt
bandit10@bandit:~$ cat data.txt

One line. Obviously not the password — but obviously not random either. Mixed-case letters and digits, no spaces, and = signs on the end. That padding is base64’s signature; once you’ve seen it a few times you clock it without thinking.

The tool is called base64 and -d decodes:

bandit10@bandit:~$ base64 -d data.txt

Done, under a minute.

the takeaway

Base64 is an encoding, not encryption. There’s no key, no secret, nothing protecting anything. It’s a way of writing arbitrary bytes using 64 characters that survive being pasted into things that only handle text — email, URLs, JSON, config files. Anyone who recognises it can reverse it, which is the point of it.

Recognise it by the alphabet (A–Z, a–z, 0–9, +, /) and the = padding at the end. base64 -d to decode, base64 with no flag to encode.

The security-relevant version of this: if you ever find credentials “protected” by base64 in a real system, they are not protected. They’re just typed differently.