script_b64variants - xforcered/python_intruder_payloads GitHub Wiki

There are many possible variants of Base64 that use different character sets. The most common variants replace the + and / characters with - and _, respectively, these are usually referred to as "Websafe Base64" or "Base64-URL". Some also remove or replace the padding (=).

Encode Base64-URL with padding:

from base64 import urlsafe_b64encode
payload = urlsafe_b64encode(current_payload)

Encode Base64-URL without padding:

from base64 import urlsafe_b64encode
payload = urlsafe_b64encode(current_payload).rstrip('=')

Encode .NET UrlToken (padding replaced with number representing number of padding characters):

from base64 import urlsafe_b64encode
unpadded = urlsafe_b64encode(current_payload).rstrip('=')
padding_needed = (4-len(unpadded))%4
payload = unpadded + str(padding_needed)