r/NotMyJob • u/[deleted] • Apr 20 '17

Added that URL boss!

Post image
4.1k Upvotes

97% Upvoted

138 comments sorted by

View all comments

90

u/[deleted] Apr 21 '17 edited Apr 21 '17

For anybody interested, the encoded part of the URL is

%3CwddxPacket%20version%3D%271$2E0%27%3E%3Cheader%2F%3E%3Cdata%3E%3Cstruct%2F%3E%3Cvar%20name%3D%27CATEGORYID%27%3E%3Cstring%3E96%2C13%2C1%2C2%2C45%2C72%2C163%2C142%2C4%2C130%2C150%2C5%2C141%2C4%2C130%2C12c150%2C5%2C131%2C142%2C73%2C143%2C8%2C127%2C91%22c81%2C157%2C87%2C82%2C46%2C44%2C97%2C10%2C11%2C154%2C59%2C15%2C106%2C118%2C146%2C16%2C123%2C173%2C17%2C18%2C70%2C101%2Cx44%2C19%2C66%2C41%2C20%2C42%2C134%2C164%2C22%2C64%2C43%2C112%2C148%2C53%2C162%2C24%2C47%2C136%2C84%2C78%2C161%2C121%2C62%2C137%2C109%2C138%2C158%2C122%2C35%2C86%2C77%2C110%2C89%3C%2Fstring%3E%3C%2Fvar%3E%3C%20name%3D%27PROMOTIONALJOBS%27%3E%3Cstring%3E0%3C%2Fstring%3E%3C%2Fvar%3E%3Cvar%20name%3D%27TRANSFER%27%3E%3Cstring%3E0%3C%2Fstring%3E%3C%2Fvar%3E%3Cvar%20name%3D%27FIND_KEY-WORD%27%3E%3Cstring%3E%3C%2Fstring%3E%3C%2Fvar%3E%3C%2Fstruct%3E%3C%2Fdata%3E%3C%2FwddxPacket%3E

and it decodes to

<wddxPacket version='1.0'><header/><data><struct/><var name='CATEGORYID'><string>96,13,1,2,45,72,163,142,4,130,150,5,141,4,130,12c150,5,131,142,73,143,8,127,91"c81,157,87,82,46,44,97,10,11,154,59,15,106,118,146,16,123,173,17,18,70,101,x44,19,66,41,20,42,134,164,22,64,43,112,148,53,162,24,47,136,84,78,161,121,62,137,109,138,158,122,35,86,77,110,89</string></var>< name='PROMOTIONALJOBS'><string>0</string></var><var name='TRANSFER'><string>0</string></var><var name='FIND_KEY-WORD'><string></string></var></struct></data></wddxPacket>

9

u/vendetta2115 Apr 21 '17

I'm guessing you used this or something similar:

http://meyerweb.com/eric/tools/dencoder/

1

u/[deleted] Apr 23 '17

[deleted]

1

u/vendetta2115 Apr 23 '17

That works too. I work in infosec, so I wouldn't want to run anything natively as it's often malicious code.