redstr/
lib.rs

1// Suppress manual_is_multiple_of lint - is_multiple_of() is unstable in stable Rust.
2// We use the % n == 0 pattern which is stable, idiomatic, and well-understood.
3// Note: This lint exists in newer clippy versions. The allow(unknown_lints) allows
4// referencing it even if it doesn't exist in the current clippy version.
5#![allow(unknown_lints)]
6#![allow(clippy::manual_is_multiple_of)]
7
8//! # redstr
9//!
10//! A comprehensive string obfuscation and transformation library for security testing,
11//! penetration testing, and red/blue/purple team operations.
12//!
13//! ## Overview
14//!
15//! `redstr` provides 60+ transformation functions organized into categories:
16//! - **Case Transformations**: Modify capitalization patterns for filter bypass
17//! - **Encoding**: Base64, URL encoding, hex encoding with various formats
18//! - **Unicode**: Homoglyphs, zalgo text, Unicode variations for IDN spoofing
19//! - **Injection Testing**: SQL, XSS, command injection, path traversal patterns
20//! - **Obfuscation**: Leetspeak, ROT13, character doubling, JavaScript obfuscation
21//! - **Phishing**: Domain typosquatting, email obfuscation, URL patterns
22//! - **Bot Detection**: User-agent strings, TLS fingerprinting, header variations
23//! - **Web Security**: JWT manipulation, GraphQL obfuscation, API endpoint testing
24//! - **Shell**: PowerShell and Bash command obfuscation
25//!
26//! ## Features
27//!
28//! - **Zero Dependencies**: Uses only Rust standard library (optional serde support)
29//! - **Security-Focused**: Designed specifically for offensive and defensive security
30//! - **Production-Ready**: Well-tested with comprehensive test coverage
31//! - **Builder Pattern**: Chain multiple transformations with `TransformBuilder`
32//!
33//! ## Quick Start
34//!
35//! ```rust
36//! use redstr::{randomize_capitalization, leetspeak, homoglyph_substitution};
37//!
38//! // Random capitalization for filter bypass
39//! let result = randomize_capitalization("Hello World");
40//! // Output: "HeLlO wOrLd" (varies each run)
41//!
42//! // Leetspeak for content filter evasion
43//! let obfuscated = leetspeak("password");
44//! // Output: "p@55w0rd" or "p4$$w0rd"
45//!
46//! // Homoglyph substitution for phishing tests
47//! let spoofed = homoglyph_substitution("admin@example.com");
48//! // Output: "аdmіn@еxаmple.com" (Cyrillic characters)
49//! ```
50//!
51//! ## Use Cases by Team
52//!
53//! ### Red Team / Offensive Security
54//! - WAF bypass with case variations and encoding
55//! - XSS payload obfuscation
56//! - SQL injection with comment insertion
57//! - Phishing domain generation
58//! - Command injection testing
59//!
60//! ### Blue Team / Defensive Security
61//! - Test security control effectiveness
62//! - Validate input sanitization
63//! - Test filter and detection systems
64//! - Verify Unicode handling
65//!
66//! ### Purple Team / Security Testing
67//! - Collaborative red/blue exercises
68//! - Security tool validation
69//! - Baseline security testing
70//!
71//! ## Transformation Categories
72//!
73//! See individual function documentation for detailed use cases and examples.
74
75mod builder;
76mod rng;
77mod transformations;
78
79// Re-export all public functions and types
80pub use builder::TransformBuilder;
81
82// Re-export case transformations
83pub use transformations::case::{
84    alternate_case, case_swap, case_swap_with_seed, inverse_case, randomize_capitalization,
85    randomize_capitalization_with_seed, to_camel_case, to_kebab_case, to_snake_case,
86};
87
88// Re-export encoding transformations
89pub use transformations::encoding::{
90    base64_encode, hex_encode, hex_encode_mixed, html_entity_encode, mixed_encoding, url_encode,
91};
92
93// Re-export unicode transformations
94pub use transformations::unicode::{
95    homoglyph_substitution, space_variants, unicode_normalize_variants, unicode_variations,
96    zalgo_text,
97};
98
99// Re-export injection transformations
100pub use transformations::injection::{
101    command_injection, couchdb_injection, dynamodb_obfuscate, mongodb_injection,
102    nosql_operator_injection, null_byte_injection, path_traversal, sql_comment_injection,
103    ssti_framework_variation, ssti_injection, ssti_syntax_obfuscate, xss_tag_variations,
104};
105
106// Re-export obfuscation transformations
107pub use transformations::obfuscation::{
108    double_characters, js_string_concat, leetspeak, reverse_string, rot13, vowel_swap,
109    whitespace_padding,
110};
111
112// Re-export phishing transformations
113pub use transformations::phishing::{
114    advanced_domain_spoof, domain_typosquat, email_obfuscation, url_shortening_pattern,
115};
116
117// Re-export bot detection transformations
118pub use transformations::bot_detection::{
119    accept_language_variation, cloudflare_challenge_variation, http2_header_order,
120    random_user_agent, tls_fingerprint_variation,
121};
122
123// Re-export cloudflare transformations
124pub use transformations::cloudflare::{
125    canvas_fingerprint_variation, cloudflare_challenge_response, cloudflare_turnstile_variation,
126    font_fingerprint_consistency, tls_handshake_pattern, webgl_fingerprint_obfuscate,
127};
128
129// Re-export web security transformations
130pub use transformations::web_security::{
131    api_endpoint_variation, graphql_introspection_bypass, graphql_obfuscate,
132    graphql_variable_injection, html_form_action_variation, html_form_field_obfuscate,
133    html_input_attribute_variation, html_input_type_variation, html_input_value_obfuscate,
134    http_header_variation, jwt_algorithm_confusion, jwt_header_manipulation, jwt_payload_obfuscate,
135    jwt_signature_bypass, session_token_variation,
136};
137
138// Re-export shell transformations
139pub use transformations::shell::{
140    bash_obfuscate, env_var_obfuscate, file_path_obfuscate, powershell_obfuscate,
141};
142
143// Re-export RNG so users can provide deterministic seeds where needed.
144pub use rng::SimpleRng;
redstr/lib.rs

redstr/
lib.rs
