ffuf / pencode Goto Github PK

Complex payload encoder

License: MIT License

Go 98.97% Shell 1.03%

pencode's Introduction

pencode - complex payload encoder

Pencode is a tool that helps you to create payload encoding chains. It has been designed to be used in automation whereever it is required to apply multiple encodings to a payload (and possibly inserting the payload to a template in between).

pencode can be used as a standalone command line tool or as a library for other Go programs.

Installation

go install github.com/ffuf/pencode/cmd/pencode@latest

Usage

pencode - complex payload encoder v0.4

Usage: ./pencode FUNC1 FUNC2 FUNC3...

./pencode reads input from stdin by default, which is typically piped from another process.

OPTIONS:
-input reads input from a file, line by line.

ENCODERS
  b64encode         - Base64 encoder
  hexencode         - Hex string encoder
  htmlescape        - HTML escape
  jsonescape        - JSON escape
  unicodeencodeall  - Unicode escape string encode (all characters)
  urlencode         - URL encode reserved characters
  urlencodeall      - URL encode all characters
  utf16             - UTF-16 encoder (Little Endian)
  utf16be           - UTF-16 encoder (Big Endian)
  xmlescape         - XML escape

DECODERS
  b64decode         - Base64 decoder
  hexdecode         - Hex string decoder
  htmlunescape      - HTML unescape
  jsonunescape      - JSON unescape
  unicodedecode     - Unicode escape string decode
  urldecode         - URL decode
  xmlunescape       - XML unescape

HASHES
  md5               - MD5 sum
  sha1              - SHA1 checksum
  sha224            - SHA224 checksum
  sha256            - SHA256 checksum
  sha384            - SHA384 checksum
  sha512            - SHA512 checksum

OTHER
  filename.tmpl     - Replaces string #PAYLOAD# in content of a file that has .tmpl extension.
  lower             - Convert string to lowercase
  upper             - Convert string to uppercase

To urlencode, base64encode and hex encode a string:

$ echo 'what%ever'|pencode urlencode b64encode hexencode
64326868644355794e5756325a58493d

Templating

Any command line parameter that is a file path ending with .tmpl is considered as a template file by pencode. It attempts to read the file content and to replace instances of a string #PAYLOAD# within the file with the input in the current encoder chain.

Shell completion

Pencode can provide tab completion for available encoders. Bash, Zsh, and Fish are supported.

$ pencode <TAB>
b64decode         hexdecode         unicodedecode     urldecode         urlencodeall      utf16be
...

In order to activate shell completion, you need to inform your shell that completion is available for your script.

Bash

To get auto-complete working you need to source the pencode-completion.bash file in your ~/.bashrc or similar:

source ~/path/to/pencode-completion.bash

Zsh

To get auto-complete working you need to enable autocomplete (not needed if you have Oh-My-Zsh) using autoload -U compaudit && compinit or by putting it into ~/.zshrc

Then source the pencode-completion.zsh file in your .zshrc or similar:

source ~/path/to/pencode-completion.zsh

Fish

To get auto-complete working you need to source the pencode-completion.fish file to your config folder ~/.config/fish/completions/pencode.fish or similar:

source ~/path/to/pencode-completion.fish

Usage as a library

package main

import (
    "fmt"
    
    "github.com/ffuf/pencode/pkg/pencode"
)

func main() {
    inputdata := "Whatever you wish to run through the chain"
    # A slice of encoders in the preferred encoding chain execution order
    encoders := []string{
        "utf16",
        "b64encode",
    }
    chain := pencode.NewChain()
    err := chain.Initialize(encoders)
    if err != nil {
        panic(err)
    }
    output, err := chain.Encode([]byte(inputdata))
    if err != nil {
        panic(err)
    }
    fmt.Print(string(output))
}

License

pencode is released under MIT license. See LICENSE.

pencode's People

Contributors

Stargazers

Watchers

pencode's Issues

suggestion: add hashes support

Hashes

MD5
SHA
SHA-1
SHA-2
SHA-3

Process line by line

Thanks for this wonderful library!

I want to pipe a whole text file line-by-line through pencode and then to ffuf.
It seems that pencode is encoding/decoding the whole file and not line-by-line.

cat special.txt
&
=

When I pipe this to pencode the newline vanishes.

cat special.txt | pencode urlencode
%26%3D

Am I missing something?
If this is the intended way would it be possible to add a switch that makes pencode process stdin line-by-line?

@joohoi

suggestion: group by type encode/hash/escape

I don't know if it's a good idea, but seeing that the tool grows I think it would be convenient to have a way to group the functions, maybe it will only be enough in the help, such as hash, encoder and escape

Encoder: URL (only "reserved" characters)

URL encoder and decoder that encodes "reserved" characters, like / and ? in the payload.

Encoder: URL (all characters)

URL encoder and decoder that encodes all the characters in the payload.

Templating: Handle replacing the keyword with input

Subtask of #8

Encoder: Hex

Hex encoder and decoder

Command line parsing

Proper command line parsing that sets up the encoder chain.

For example: pencode b64 hex somethingelse which would read payload from stdin, base64 encode it, then hex encode the result and "somethingelse" encode it before outputting the result to stdout.

Templating: List available templates when pencode is run without arguments

Subtask of #8

Encoder: Unicode

Unicode encoder and decoder

suggestion: skip char when decode error

suggestion: skip char when decode error,continue to decode to last char, instead of return error, thank you~

for example:

└─$ echo "3C 3F 70 68 70 20 40 65 76 61 6C 28 24 5F 50 4F 53 54 5B ?? 70 61 73 73 77 6F 72 64 ?? 5D 29 3B 3F 3E"|pencode
 hexdecode
  [!] encoding/hex: invalid byte: U+003F '?'

┌──()-[~/go/bin]
└─$ echo "3C 3F 70 68 70 20 40 65 76 61 6C 28 24 5F 50 4F 53 54 5B 70 61 73 73 77 6F 72 64 ?? 5D 29 3B 3F 3E"|pencode he
xdecode
  [!] encoding/hex: invalid byte: U+003F '?'

┌──()-[~/go/bin]
└─$ echo "3C 3F 70 68 70 20 40 65 76 61 6C 28 24 5F 50 4F 53 54 5B 70 61 73 73 77 6F 72 64 5D 29 3B 3F 3E"|pencode hexde
code
<?php @eval($_POST[password]);?>

Encoder: UTF-7

UTF-7 encoder and decoder

Templating: Basics

The payload templates can be for example JSON structures that the payload needs to get added into.

pencode tries to read following directories on startup to determine available templates:

$HOME/.pencode/templates/
/etc/pencode/templates/

The template files which have a file extension .penc will be read into memory and the basename of the template file name will be added to pencode "action" list.

Within the payload template, a keyword #PENCODE# will be replaced with the payload read from stdin or passed from the previous step of the chain.

In the example use case in order to first base64 encode the payload, then add it to a JSON structure in a template, and to URL encode the resulting string:

We have a payload file: /home/username/.pencode/templates/json_template_example.penc, so a new "action" named json_template_example is added for pencode command.

Our command line would hence be: pencode base64 json_template_example urlencode

Subtasks for this issue:

Read template files from filesystem and add the proper actions: #9
List available templates when pencode is run without arguments: #10
Handle replacing the keyword with input #11

Templating: Read template files from filesystem and add the proper actions

Subtask of #8

Encoder: UTF-16

UTF-16 encoder and decoder

ffuf / pencode Goto Github PK

pencode's Introduction

pencode - complex payload encoder

Installation

Usage

Templating

Shell completion

Bash

Zsh

Fish

Usage as a library

License

pencode's People

Contributors

Stargazers

Watchers

Forkers

pencode's Issues

Hashes

Recommend Projects

Recommend Topics

Recommend Org