''' rndHexEncode.py Copyright 2006 Andres Riancho This file is part of w3af, w3af.sourceforge.net . w3af is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation version 2 of the License. w3af is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with w3af; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA ''' from core.controllers.basePlugin.baseEvasionPlugin import baseEvasionPlugin from core.controllers.w3afException import w3afException from random import choice, randint class rndHexEncode(baseEvasionPlugin): ''' This evasion plugin adds random hex encoding. @author: Andres Riancho ( andres.riancho@gmail.com ) ''' def __init__(self): baseEvasionPlugin.__init__(self) def fuzzUrl(self, path ): ''' Mangles the URI. @parameter url: A string containing the Url to mangle ( '/bar/foo.php' ) ''' newpath = '' for char in path: if char not in ['?', '/', '&', '\\', '=', '%', '+']: if randint(1,2) == 2: char = "%%%02x" % ord(char) newpath += char return newpath def getOptionsXML(self): ''' This method returns a XML containing the Options that the plugin has. Using this XML the framework will build a window, a menu, or some other input method to retrieve the info from the user. The XML has to validate against the xml schema file located at : w3af/core/ui/userInterface.dtd @return: XML with the plugin options. ''' return '\ \ \ ' def setOptions( self, OptionList ): ''' This method sets all the options that are configured using the user interface generated by the framework using the result of getOptionsXML(). @parameter OptionList: A dictionary with the options for the plugin. @return: No value is returned. ''' pass def getPluginDeps( self ): return [] def getPriority( self ): ''' This function is called when sorting evasion plugins. Each evasion plugin should implement this. @return: An integer specifying the priority. 0 is runned first, 100 last. ''' return 50 def getLongDesc( self ): ''' @return: A DETAILED description of the plugin functions and features. ''' return ''' This evasion plugin adds random hex encoding. Example: Input: '/bar/foo.asp' Output : '/b%61r/%66oo.asp' '''