From 269a27f88669beb23a39c7d0b72d470f9e416f85 Mon Sep 17 00:00:00 2001
From: ekultek <thomas.perkins23@icloud.com>
Date: Tue, 10 Oct 2017 17:00:18 -0500
Subject: [PATCH] moved tamper scripts outside of attacks folder

---
 lib/tamper_scripts/__init__.py          |  0
 lib/tamper_scripts/base64_encode.py     | 15 +++++++++
 lib/tamper_scripts/hex_encode.py        | 16 +++++++++
 lib/tamper_scripts/lowercase_encode.py  |  2 ++
 lib/tamper_scripts/randomcase_encode.py | 14 ++++++++
 lib/tamper_scripts/unicode_encode.py    |  8 +++++
 lib/tamper_scripts/uppercase_encode.py  |  2 ++
 lib/tamper_scripts/url_encode.py        | 45 +++++++++++++++++++++++++
 8 files changed, 102 insertions(+)
 create mode 100644 lib/tamper_scripts/__init__.py
 create mode 100644 lib/tamper_scripts/base64_encode.py
 create mode 100644 lib/tamper_scripts/hex_encode.py
 create mode 100644 lib/tamper_scripts/lowercase_encode.py
 create mode 100644 lib/tamper_scripts/randomcase_encode.py
 create mode 100644 lib/tamper_scripts/unicode_encode.py
 create mode 100644 lib/tamper_scripts/uppercase_encode.py
 create mode 100644 lib/tamper_scripts/url_encode.py

diff --git a/lib/tamper_scripts/__init__.py b/lib/tamper_scripts/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/lib/tamper_scripts/base64_encode.py b/lib/tamper_scripts/base64_encode.py
new file mode 100644
index 0000000..d214fb4
--- /dev/null
+++ b/lib/tamper_scripts/base64_encode.py
@@ -0,0 +1,15 @@
+import base64
+
+from lib.core.settings import (
+    logger,
+    set_color
+)
+
+
+def tamper(payload, warning=True, **kwargs):
+    if warning:
+        logger.warning(set_color(
+            "base64 tamper scripts may increase the possibility of not finding vulnerabilities "
+            "in otherwise vulnerable sites...", level=30
+        ))
+    return base64.b64encode(payload)
\ No newline at end of file
diff --git a/lib/tamper_scripts/hex_encode.py b/lib/tamper_scripts/hex_encode.py
new file mode 100644
index 0000000..36db53b
--- /dev/null
+++ b/lib/tamper_scripts/hex_encode.py
@@ -0,0 +1,16 @@
+from lib.core.settings import (
+    logger,
+    set_color
+)
+
+
+def tamper(payload, warning=True, **kwargs):
+    if warning:
+        logger.warning(set_color(
+            "hex tamper scripts may increase the risk of false positives...", level=30
+        ))
+    retval = hex(hash(payload))
+    if "-" in str(retval):
+        return retval[1:-1]
+    else:
+        return retval
diff --git a/lib/tamper_scripts/lowercase_encode.py b/lib/tamper_scripts/lowercase_encode.py
new file mode 100644
index 0000000..f81573c
--- /dev/null
+++ b/lib/tamper_scripts/lowercase_encode.py
@@ -0,0 +1,2 @@
+def tamper(payload, **kwargs):
+    return str(payload).lower()
\ No newline at end of file
diff --git a/lib/tamper_scripts/randomcase_encode.py b/lib/tamper_scripts/randomcase_encode.py
new file mode 100644
index 0000000..0a9ffeb
--- /dev/null
+++ b/lib/tamper_scripts/randomcase_encode.py
@@ -0,0 +1,14 @@
+import random
+
+
+def tamper(payload, **kwargs):
+    retval = ""
+    nums = [0, 1]
+
+    for char in payload:
+        random_int = random.choice(nums)
+        if random_int == 1:
+            retval += char.upper()
+        else:
+            retval += char
+    return retval
diff --git a/lib/tamper_scripts/unicode_encode.py b/lib/tamper_scripts/unicode_encode.py
new file mode 100644
index 0000000..1433fa7
--- /dev/null
+++ b/lib/tamper_scripts/unicode_encode.py
@@ -0,0 +1,8 @@
+def tamper(payload, **kwargs):
+    i = 0
+    retval = ""
+
+    while i < len(payload):
+        retval += "%u{}".format(ord(payload[i]))
+        i += 1
+    return retval
diff --git a/lib/tamper_scripts/uppercase_encode.py b/lib/tamper_scripts/uppercase_encode.py
new file mode 100644
index 0000000..792cca4
--- /dev/null
+++ b/lib/tamper_scripts/uppercase_encode.py
@@ -0,0 +1,2 @@
+def tamper(payload, **kwargs):
+    return str(payload).upper()
\ No newline at end of file
diff --git a/lib/tamper_scripts/url_encode.py b/lib/tamper_scripts/url_encode.py
new file mode 100644
index 0000000..32eee14
--- /dev/null
+++ b/lib/tamper_scripts/url_encode.py
@@ -0,0 +1,45 @@
+# coding=utf-8
+
+
+def tamper(payload, safe="%&=-_", **kwargs):
+    encodings = {
+        " ": "%20", "!": "%21", '"': "%22", "#": "%23", "$": "%24", "%": "%25", "&": "%26", "'": "%27",
+        "(": "%28", ")": "%29", "*": "%2A", "+": "%2B", ",": "%2C", "-": "%2D", ".": "%2E", "/": "%2F",
+        "0": "%30", "1": "%31", "2": "%32", "3": "%33", "4": "%34", "5": "%35", "6": "%36", "7": "%37",
+        "8": "%38", "9": "%39", ":": "%3A", ";": "%3B", "<": "%3C", "=": "%3D", ">": "%3E", "?": "%3F",
+        "@": "%40", "A": "%41", "B": "%42", "C": "%43", "D": "%44", "E": "%45", "F": "%46", "G": "%47",
+        "H": "%48", "I": "%49", "J": "%4A", "K": "%4B", "L": "%4C", "M": "%4D", "N": "%4E", "O": "%4F",
+        "P": "%50", "Q": "%51", "R": "%52", "S": "%53", "T": "%54", "U": "%55", "V": "%56", "W": "%57",
+        "X": "%58", "Y": "%59", "Z": "%5A", "[": "%5B", "\\": "%5C", "]": "%5D", "^": "%5E", "a": "%61",
+        "b": "%62", "c": "%63", "d": "%64", "e": "%65", "f": "%66", "g": "%67", "h": "%68", "i": "%69",
+        "j": "%6A", "k": "%6B", "l": "%6C", "m": "%6D", "n": "%6E", "o": "%6F", "p": "%70", "q": "%71",
+        "r": "%72", "s": "%73", "t": "%74", "u": "%75", "v": "%76", "w": "%77", "x": "%78", "y": "%79",
+        "z": "%7A", "{": "%7B", "|": "%7C", "}": "%7D", "~": "%7E", "`": "%80", "": "%81", "‚": "%82",
+        "ƒ": "%83", "„": "%84", "…": "%85", "†": "%86", "‡": "%87", "ˆ": "%88", "‰": "%89", "Š": "%8A",
+        "‹": "%8B", "Œ": "%8C", "Ž": "%8E", "‘": "%91", "’": "%92", "“": "%93", "”": "%94", "•": "%95",
+        "–": "%96", "—": "%97", "˜": "%98", "™": "%99", "š": "%9A", "›": "%9B", "œ": "%9C", "ž": "%9E",
+        "Ÿ": "%9F", "¡": "%A1", "¢": "%A2", "£": "%A3", "¤": "%A4", "¥": "%A5", "¦": "%A6", "§": "%A7",
+        "¨": "%A8", "©": "%A9", "ª": "%AA", "«": "%AB", "¬": "%AC", "­": "%AD", "®": "%AE", "¯": "%AF",
+        "°": "%B0", "±": "%B1", "²": "%B2", "³": "%B3", "´": "%B4", "µ": "%B5", "¶": "%B6", "·": "%B7",
+        "¸": "%B8", "¹": "%B9", "º": "%BA", "»": "%BB", "¼": "%BC", "½": "%BD", "¾": "%BE", "¿": "%BF",
+        "À": "%C0", "Á": "%C1", "Â": "%C2", "Ã": "%C3", "Ä": "%C4", "Å": "%C5", "Æ": "%C6", "Ç": "%C7",
+        "È": "%C8", "É": "%C9", "Ê": "%CA", "Ë": "%CB", "Ì": "%CC", "Í": "%CD", "Î": "%CE", "Ï": "%CF",
+        "Ð": "%D0", "Ñ": "%D1", "Ò": "%D2", "Ó": "%D3", "Ô": "%D4", "Õ": "%D5", "Ö": "%D6", "×": "%D7",
+        "Ø": "%D8", "Ù": "%D9", "Ú": "%DA", "Û": "%DB", "Ü": "%DC", "Ý": "%DD", "Þ": "%DE", "ß": "%DF",
+        "à": "%E0", "á": "%E1", "â": "%E2", "ã": "%E3", "ä": "%E4", "å": "%E5", "æ": "%E6", "ç": "%E7",
+        "è": "%E8", "é": "%E9", "ê": "%EA", "ë": "%EB", "ì": "%EC", "í": "%ED", "î": "%EE", "ï": "%EF",
+        "ð": "%F0", "ñ": "%F1", "ò": "%F2", "ó": "%F3", "ô": "%F4", "õ": "%F5", "ö": "%F6", "÷": "%F7",
+        "ø": "%F8", "ù": "%F9", "ú": "%FA", "û": "%FB", "ü": "%FC", "ý": "%FD", "þ": "%FE", "ÿ": "%FF"
+    }
+    retval = ""
+    if isinstance(payload, unicode):
+        payload = str(payload)
+    for char in payload:
+        if char not in safe:
+            try:
+                retval += encodings[char]
+            except KeyError:
+                retval += char
+        else:
+            retval += char
+    return retval