Skip to content

Conversation

@yuunaka1
Copy link

@yuunaka1 yuunaka1 commented Feb 5, 2025

The accessToken (JWS Payload) uses Base64URL encoding, not Base64 encoding. Therefore, the base64.RawURLEncoding function should be used for the decoding.
ref: https://datatracker.ietf.org/doc/html/rfc7515#section-7.1

The body (JWS Payload) uses Base64URL encoding, not Base64 encoding. Therefore, the base64.RawURLEncoding function must be used for the decoding.
@github-actions
Copy link

github-actions bot commented Feb 5, 2025

CLA Assistant Lite bot All contributors have signed the CLA ✍️ ✅

@yuunaka1
Copy link
Author

yuunaka1 commented Feb 5, 2025

I have read the CLA Document and I hereby sign the CLA

@KinakoExE
Copy link

@mvlipka @ddlees
Hello, I encountered an AzureHound bug that throws the error:
illegal base64 data at input byte XXX.
This PR resolves the issue, so I would strongly recommend merging it.

Problem

Entra ID returns URL-safe base64-encoded JWTs. However, AzureHound attempts to decode them using the standard (non–URL-safe) base64 decoder. As a result, even valid access tokens can trigger a fatal error.

Here’s a real example I ran into:

$ ./azurehound list -t "$TENANT_ID" -j "$ACCESS_TOKEN" -o output.json -v 1
...
No configuration file located at /home/kali/.config/azurehound/config.json
2025-08-21T13:15:50+09:00 DBG testing connections
2025-08-21T13:15:50+09:00 DBG testing connections
2025-08-21T13:15:50+09:00 ERR encountered unrecoverable error error="failed to create new Azure client: illegal base64 data at input byte 634"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants