Classify the outermost layer
Start with visible constraints. Percent escapes such as %7B suggest URL encoding. Long runs of hexadecimal pairs suggest hex. Groups of eight zeroes and ones suggest binary bytes. A restricted alphanumeric alphabet with optional padding suggests Base64. Alphabetic text that remains word-shaped but unreadable may justify testing ROT13.
These are hypotheses, not verdicts. The correct transformation should produce stronger structure: readable text, valid JSON, a known file signature, or another encoding with clearer evidence.
Walk through a two-layer example
Suppose a challenge provides:
NDY0YzQxNDc3YjYzNjg2MTY5NmU3ZA==The outer string fits standard Base64. Decode once:
464c41477b636861696e7dThe output now contains only hexadecimal characters and has an even length. Hex decoding produces:
FLAG{chain}The result gained structure at both steps. The defensible chain is therefore Base64 decode → Hex decode.
Record the chain as evidence
For every step, save the exact input, operation, output, and reason for continuing. Do not overwrite the only copy of an intermediate value. Hexforge's toolchain keeps the ordered operations visible and provides an execution trace so a teammate can reproduce the result.
| Step | Observation | Action |
|---|---|---|
| 0 | Base64 alphabet and valid grouping | Decode Base64 |
| 1 | Even-length hex pairs | Decode hex |
| 2 | Readable flag format | Stop and verify |
Know when to stop
Stop when a result satisfies the challenge context, when the next operation lacks a clear signal, or when output entropy rises without revealing structure. Repeatedly applying every decoder creates false positives and makes the process difficult to explain.
If data was encoded as text → hex → Base64, recovery applies Base64 decode first, then hex decode. The outermost visible layer is removed first.
Common failure modes
Confusing encoding with encryption
Base64, hex, URL encoding, binary representation, and ROT13 do not use a secret key. If evidence points to cryptography, adding more decoders will not recover the plaintext.
Normalizing too aggressively
Whitespace may be cosmetic, but punctuation can be meaningful. Preserve the original before removing prefixes, padding, delimiters, or line breaks.
Accepting readable nonsense
A short printable result is not automatically correct. Check it against the expected flag syntax, file type, protocol field, or narrative clue.
A repeatable method
- Preserve the raw value.
- Write down the strongest outer-layer signals.
- Apply one justified operation.
- Identify the new output type before continuing.
- Save every intermediate result.
- Stop when context and structure agree.