Code examples from 'Internet Forensics'
Chapter 4 (Obfuscation)

Example 4-1: decode_hex_url.pl
#!/usr/bin/perl -w 
# Example 4-1: decode_hex_url.pl

# Excerpted from 'Internet Forensics' by Robert Jones
# Published 2005 by O'Reilly Media (ISBN 0-596-10006-X)

die "Usage: $0 <hex encoded URL>" unless @ARGV == 1;
$ARGV[0] =~ s/\%(..)/chr hex $1/ge;
print $ARGV[0] . "\n";

Example 4-2: encode_hex_url.pl
#!/usr/bin/perl -w
# Example 4-2: encode_hex_url.pl

# Excerpted from 'Internet Forensics' by Robert Jones
# Published 2005 by O'Reilly Media (ISBN 0-596-10006-X)

die "Usage: $0 <ASCII URL>" unless @ARGV == 1;
for(my $i=0; $i < length $ARGV[0]; $i++) {
    my $c = substr($ARGV[0], $i, 1);
    printf "%%%02lx", ord $c;
}
print "\n";

Example 4-3: encode_octal_url.pl
#!/usr/bin/perl -w
# Example 4-3: encode_octal_url.pl

# Excerpted from 'Internet Forensics' by Robert Jones
# Published 2005 by O'Reilly Media (ISBN 0-596-10006-X)

die "Usage: $0 <dotted quad IP addr>\n" unless @ARGV == 1;
my @words = ();
foreach my $word (split /\./, $ARGV[0]) {
   push @words, sprintf "0%03lo", $word;
}
printf "%s\n", join '.', @words;

Example 4-4: decode_octal_url.pl
#!/usr/bin/perl -w
# Example 4-4: decode_octal_url.pl

# Excerpted from 'Internet Forensics' by Robert Jones
# Published 2005 by O'Reilly Media (ISBN 0-596-10006-X)

die "Usage: $0 <octal encoded URL>\n" unless @ARGV == 1;
$ARGV[0] =~ s/(0\d\d\d)/oct $1/ge;
print $ARGV[0] . "\n";