ip_obfuscator.py

#!/usr/bin/env python3
"""
IP Address Obfuscation Tool
"""

import ipaddress
import json
import random
import sys
import urllib.parse
from typing import Dict, Optional


class IPObfuscator:
    """Generate all known obfuscated representations of an IPv4 address."""
    
    def __init__(self, ip_str: str):
        """Initialize with a standard IPv4 address string."""
        self.ip = ipaddress.IPv4Address(ip_str)
        self.octets = list(self.ip.packed)
        self.integer = int(self.ip)
    
    # =========================================================================
    # STANDARD FORMATS
    # =========================================================================
    
    def standard_dotted_decimal(self) -> str:
        """Standard format: 192.168.1.1"""
        return str(self.ip)
    
    # =========================================================================
    # INTEGER/DWORD FORMATS
    # =========================================================================
    
    def decimal_dword(self) -> str:
        """
        Single 32-bit decimal integer (DWORD).
        Example: 192.168.1.1 -> 3232235777
        
        Used by: SMOKELOADER, phishing campaigns
        Source: Mandiant, Zscaler, Trustwave
        """
        return str(self.integer)
    
    def hex_dword(self) -> str:
        """
        Single hexadecimal integer with 0x prefix.
        Example: 192.168.1.1 -> 0xC0A80101
        
        Source: Trustwave SpiderLabs
        """
        return f"0x{self.integer:08X}"
    
    def hex_dword_lowercase(self) -> str:
        """Lowercase hex: 0xc0a80101"""
        return f"0x{self.integer:08x}"

    def octal_dword(self) -> str:
        """
        Single 32-bit octal integer (DWORD).
        Example: 192.168.1.1 -> 030052000401

        Leading 0 indicates octal notation.
        Works in: curl, Chrome, Safari, Firefox
        Source: inet_aton() man page
        """
        return f"0{self.integer:o}"

    # =========================================================================
    # DOTTED NOTATION VARIANTS
    # =========================================================================
    
    def dotted_hex(self) -> str:
        """
        Each octet as hex with 0x prefix.
        Example: 192.168.1.1 -> 0xC0.0xA8.0x1.0x1
        
        Used in: Bank phishing, PayPal scams
        Source: Eric Conrad, SANS
        """
        return '.'.join(f'0x{o:X}' for o in self.octets)
    
    def dotted_hex_lowercase(self) -> str:
        """Lowercase dotted hex: 0xc0.0xa8.0x1.0x1"""
        return '.'.join(f'0x{o:x}' for o in self.octets)
    
    def dotted_hex_padded(self) -> str:
        """
        Padded dotted hex (2 digits per octet).
        Example: 192.168.1.1 -> 0xC0.0xA8.0x01.0x01
        """
        return '.'.join(f'0x{o:02X}' for o in self.octets)
    
    def dotted_hex_long_padded(self) -> str:
        """
        Extra padded hex (used in real phishing).
        Example: 0x000000C0.0x000000A8.0x00000001.0x00000001
        
        Source: Eric Conrad - MSN phishing example
        """
        return '.'.join(f'0x{o:08X}' for o in self.octets)
    
    def dotted_octal(self) -> str:
        """
        Each octet as octal with leading 0.
        Example: 192.168.1.1 -> 0300.0250.01.01
        
        Used by: Emotet malware
        Source: McAfee, Trend Micro
        """
        return '.'.join(f'0{o:o}' for o in self.octets)
    
    def dotted_octal_padded(self) -> str:
        """
        Padded octal (3 digits minimum).
        Example: 192.168.1.1 -> 0300.0250.0001.0001
        """
        return '.'.join(f'0{o:03o}' for o in self.octets)
    
    def dotted_octal_long_padded(self) -> str:
        """
        Extra padded octal.
        Example: 0000000300.0000000250.0000000001.0000000001
        """
        return '.'.join(f'0{o:09o}' for o in self.octets)
    
    # =========================================================================
    # MIXED NOTATION (DIFFERENT BASES)
    # =========================================================================
    
    def mixed_hex_decimal(self) -> str:
        """
        Mix of hex and decimal.
        Example: 0xC0.168.0x1.1
        """
        return f"0x{self.octets[0]:X}.{self.octets[1]}.0x{self.octets[2]:X}.{self.octets[3]}"
    
    def mixed_octal_decimal(self) -> str:
        """
        Mix of octal and decimal.
        Example: 0300.168.01.1
        """
        return f"0{self.octets[0]:o}.{self.octets[1]}.0{self.octets[2]:o}.{self.octets[3]}"
    
    def mixed_all_bases(self) -> str:
        """
        Mix of decimal, hex, and octal.
        Example: 192.0xa8.01.0x1
        """
        return f"{self.octets[0]}.0x{self.octets[1]:x}.0{self.octets[2]:o}.0x{self.octets[3]:x}"
    
    def random_mixed(self) -> str:
        """Randomly mix bases for each octet."""
        result = []
        for o in self.octets:
            fmt = random.choice(['dec', 'hex', 'oct'])
            if fmt == 'dec':
                result.append(str(o))
            elif fmt == 'hex':
                result.append(f'0x{o:x}')
            else:
                result.append(f'0{o:o}')
        return '.'.join(result)

    # =========================================================================
    # PARTIAL HEX CONVERSIONS (first N or last N octets)
    # =========================================================================

    def hex_first_3(self) -> str:
        """First 3 octets as hex, last as decimal."""
        return f"0x{self.octets[0]:X}.0x{self.octets[1]:X}.0x{self.octets[2]:X}.{self.octets[3]}"

    def hex_first_2(self) -> str:
        """First 2 octets as hex, last 2 as decimal."""
        return f"0x{self.octets[0]:X}.0x{self.octets[1]:X}.{self.octets[2]}.{self.octets[3]}"

    def hex_first_1(self) -> str:
        """First octet as hex, rest as decimal."""
        return f"0x{self.octets[0]:X}.{self.octets[1]}.{self.octets[2]}.{self.octets[3]}"

    def hex_last_3(self) -> str:
        """First as decimal, last 3 as hex."""
        return f"{self.octets[0]}.0x{self.octets[1]:X}.0x{self.octets[2]:X}.0x{self.octets[3]:X}"

    def hex_last_2(self) -> str:
        """First 2 as decimal, last 2 as hex."""
        return f"{self.octets[0]}.{self.octets[1]}.0x{self.octets[2]:X}.0x{self.octets[3]:X}"

    def hex_last_1(self) -> str:
        """First 3 as decimal, last as hex."""
        return f"{self.octets[0]}.{self.octets[1]}.{self.octets[2]}.0x{self.octets[3]:X}"

    # =========================================================================
    # PARTIAL OCTAL CONVERSIONS (first N or last N octets)
    # =========================================================================

    def octal_first_3(self) -> str:
        """First 3 octets as octal, last as decimal."""
        return f"0{self.octets[0]:o}.0{self.octets[1]:o}.0{self.octets[2]:o}.{self.octets[3]}"

    def octal_first_2(self) -> str:
        """First 2 octets as octal, last 2 as decimal."""
        return f"0{self.octets[0]:o}.0{self.octets[1]:o}.{self.octets[2]}.{self.octets[3]}"

    def octal_first_1(self) -> str:
        """First octet as octal, rest as decimal."""
        return f"0{self.octets[0]:o}.{self.octets[1]}.{self.octets[2]}.{self.octets[3]}"

    def octal_last_3(self) -> str:
        """First as decimal, last 3 as octal."""
        return f"{self.octets[0]}.0{self.octets[1]:o}.0{self.octets[2]:o}.0{self.octets[3]:o}"

    def octal_last_2(self) -> str:
        """First 2 as decimal, last 2 as octal."""
        return f"{self.octets[0]}.{self.octets[1]}.0{self.octets[2]:o}.0{self.octets[3]:o}"

    def octal_last_1(self) -> str:
        """First 3 as decimal, last as octal."""
        return f"{self.octets[0]}.{self.octets[1]}.{self.octets[2]}.0{self.octets[3]:o}"

    # =========================================================================
    # PARTIAL HEX WITH LONG PADDING
    # =========================================================================

    def hex_padded_first_3(self) -> str:
        """First 3 octets as padded hex (8 digits), last as decimal."""
        return f"0x{self.octets[0]:08X}.0x{self.octets[1]:08X}.0x{self.octets[2]:08X}.{self.octets[3]}"

    def hex_padded_first_2(self) -> str:
        """First 2 octets as padded hex, last 2 as decimal."""
        return f"0x{self.octets[0]:08X}.0x{self.octets[1]:08X}.{self.octets[2]}.{self.octets[3]}"

    def hex_padded_first_1(self) -> str:
        """First octet as padded hex, rest as decimal."""
        return f"0x{self.octets[0]:08X}.{self.octets[1]}.{self.octets[2]}.{self.octets[3]}"

    # =========================================================================
    # PARTIAL OCTAL WITH LONG PADDING
    # =========================================================================

    def octal_padded_first_3(self) -> str:
        """First 3 octets as padded octal (8 digits), last as decimal."""
        return f"0{self.octets[0]:08o}.0{self.octets[1]:08o}.0{self.octets[2]:08o}.{self.octets[3]}"

    def octal_padded_first_2(self) -> str:
        """First 2 octets as padded octal, last 2 as decimal."""
        return f"0{self.octets[0]:08o}.0{self.octets[1]:08o}.{self.octets[2]}.{self.octets[3]}"

    def octal_padded_first_1(self) -> str:
        """First octet as padded octal, rest as decimal."""
        return f"0{self.octets[0]:08o}.{self.octets[1]}.{self.octets[2]}.{self.octets[3]}"

    # =========================================================================
    # THREE-WAY BASE MIXING (hex, octal, decimal permutations)
    # =========================================================================

    def mix_hex_oct_dec_dec(self) -> str:
        """hex.oct.dec.dec"""
        return f"0x{self.octets[0]:X}.0{self.octets[1]:o}.{self.octets[2]}.{self.octets[3]}"

    def mix_hex_dec_oct_dec(self) -> str:
        """hex.dec.oct.dec"""
        return f"0x{self.octets[0]:X}.{self.octets[1]}.0{self.octets[2]:o}.{self.octets[3]}"

    def mix_hex_dec_dec_oct(self) -> str:
        """hex.dec.dec.oct"""
        return f"0x{self.octets[0]:X}.{self.octets[1]}.{self.octets[2]}.0{self.octets[3]:o}"

    def mix_hex_oct_oct_dec(self) -> str:
        """hex.oct.oct.dec"""
        return f"0x{self.octets[0]:X}.0{self.octets[1]:o}.0{self.octets[2]:o}.{self.octets[3]}"

    def mix_hex_oct_dec_oct(self) -> str:
        """hex.oct.dec.oct"""
        return f"0x{self.octets[0]:X}.0{self.octets[1]:o}.{self.octets[2]}.0{self.octets[3]:o}"

    def mix_hex_dec_oct_oct(self) -> str:
        """hex.dec.oct.oct"""
        return f"0x{self.octets[0]:X}.{self.octets[1]}.0{self.octets[2]:o}.0{self.octets[3]:o}"

    def mix_oct_hex_dec_dec(self) -> str:
        """oct.hex.dec.dec"""
        return f"0{self.octets[0]:o}.0x{self.octets[1]:X}.{self.octets[2]}.{self.octets[3]}"

    def mix_oct_dec_hex_dec(self) -> str:
        """oct.dec.hex.dec"""
        return f"0{self.octets[0]:o}.{self.octets[1]}.0x{self.octets[2]:X}.{self.octets[3]}"

    def mix_oct_dec_dec_hex(self) -> str:
        """oct.dec.dec.hex"""
        return f"0{self.octets[0]:o}.{self.octets[1]}.{self.octets[2]}.0x{self.octets[3]:X}"

    def mix_oct_hex_hex_dec(self) -> str:
        """oct.hex.hex.dec"""
        return f"0{self.octets[0]:o}.0x{self.octets[1]:X}.0x{self.octets[2]:X}.{self.octets[3]}"

    def mix_oct_hex_dec_hex(self) -> str:
        """oct.hex.dec.hex"""
        return f"0{self.octets[0]:o}.0x{self.octets[1]:X}.{self.octets[2]}.0x{self.octets[3]:X}"

    def mix_oct_dec_hex_hex(self) -> str:
        """oct.dec.hex.hex"""
        return f"0{self.octets[0]:o}.{self.octets[1]}.0x{self.octets[2]:X}.0x{self.octets[3]:X}"

    def mix_dec_hex_oct_dec(self) -> str:
        """dec.hex.oct.dec"""
        return f"{self.octets[0]}.0x{self.octets[1]:X}.0{self.octets[2]:o}.{self.octets[3]}"

    def mix_dec_hex_dec_oct(self) -> str:
        """dec.hex.dec.oct"""
        return f"{self.octets[0]}.0x{self.octets[1]:X}.{self.octets[2]}.0{self.octets[3]:o}"

    def mix_dec_oct_hex_dec(self) -> str:
        """dec.oct.hex.dec"""
        return f"{self.octets[0]}.0{self.octets[1]:o}.0x{self.octets[2]:X}.{self.octets[3]}"

    def mix_dec_oct_dec_hex(self) -> str:
        """dec.oct.dec.hex"""
        return f"{self.octets[0]}.0{self.octets[1]:o}.{self.octets[2]}.0x{self.octets[3]:X}"

    def mix_dec_dec_hex_oct(self) -> str:
        """dec.dec.hex.oct"""
        return f"{self.octets[0]}.{self.octets[1]}.0x{self.octets[2]:X}.0{self.octets[3]:o}"

    def mix_dec_dec_oct_hex(self) -> str:
        """dec.dec.oct.hex"""
        return f"{self.octets[0]}.{self.octets[1]}.0{self.octets[2]:o}.0x{self.octets[3]:X}"

    def mix_dec_hex_oct_oct(self) -> str:
        """dec.hex.oct.oct"""
        return f"{self.octets[0]}.0x{self.octets[1]:X}.0{self.octets[2]:o}.0{self.octets[3]:o}"

    def mix_dec_oct_hex_hex(self) -> str:
        """dec.oct.hex.hex"""
        return f"{self.octets[0]}.0{self.octets[1]:o}.0x{self.octets[2]:X}.0x{self.octets[3]:X}"

    def mix_dec_oct_oct_hex(self) -> str:
        """dec.oct.oct.hex"""
        return f"{self.octets[0]}.0{self.octets[1]:o}.0{self.octets[2]:o}.0x{self.octets[3]:X}"

    def mix_dec_hex_hex_oct(self) -> str:
        """dec.hex.hex.oct"""
        return f"{self.octets[0]}.0x{self.octets[1]:X}.0x{self.octets[2]:X}.0{self.octets[3]:o}"

    def mix_hex_oct_hex_dec(self) -> str:
        """hex.oct.hex.dec"""
        return f"0x{self.octets[0]:X}.0{self.octets[1]:o}.0x{self.octets[2]:X}.{self.octets[3]}"

    def mix_hex_dec_hex_oct(self) -> str:
        """hex.dec.hex.oct"""
        return f"0x{self.octets[0]:X}.{self.octets[1]}.0x{self.octets[2]:X}.0{self.octets[3]:o}"

    def mix_oct_hex_oct_dec(self) -> str:
        """oct.hex.oct.dec"""
        return f"0{self.octets[0]:o}.0x{self.octets[1]:X}.0{self.octets[2]:o}.{self.octets[3]}"

    def mix_oct_dec_oct_hex(self) -> str:
        """oct.dec.oct.hex"""
        return f"0{self.octets[0]:o}.{self.octets[1]}.0{self.octets[2]:o}.0x{self.octets[3]:X}"

    # =========================================================================
    # RANDOM PADDING TECHNIQUES
    # =========================================================================

    def random_hex_padding(self) -> str:
        """Each octet as hex with random padding (1-8 zeros)."""
        result = []
        for o in self.octets:
            padding = random.randint(1, 8)
            result.append(f"0x{'0' * padding}{o:X}")
        return '.'.join(result)

    def random_octal_padding(self) -> str:
        """Each octet as octal with random padding (1-8 zeros)."""
        result = []
        for o in self.octets:
            padding = random.randint(1, 8)
            result.append(f"{'0' * padding}{o:o}")
        return '.'.join(result)

    def random_mixed_padding(self) -> str:
        """Mix of bases with random padding."""
        result = []
        for o in self.octets:
            fmt = random.choice(['dec', 'hex', 'oct'])
            padding = random.randint(0, 6)
            if fmt == 'dec':
                result.append(str(o))
            elif fmt == 'hex':
                result.append(f"0x{'0' * padding}{o:x}")
            else:
                result.append(f"{'0' * padding}{o:o}")
        return '.'.join(result)

    # =========================================================================
    # MIXED CLASS SHORTHAND WITH HEX/OCTAL PREFIX
    # =========================================================================

    def hex_class_c(self) -> str:
        """Hex first 2 octets + Class C merge (16-bit).
        Example: 0xC0.0xA8.16898"""
        merged = (self.octets[2] << 8) | self.octets[3]
        return f"0x{self.octets[0]:X}.0x{self.octets[1]:X}.{merged}"

    def hex_class_b(self) -> str:
        """Hex first octet + Class B merge (24-bit).
        Example: 0xC0.11026946"""
        merged = (self.octets[1] << 16) | (self.octets[2] << 8) | self.octets[3]
        return f"0x{self.octets[0]:X}.{merged}"

    def octal_class_c(self) -> str:
        """Octal first 2 octets + Class C merge (16-bit).
        Example: 0300.0250.16898"""
        merged = (self.octets[2] << 8) | self.octets[3]
        return f"0{self.octets[0]:o}.0{self.octets[1]:o}.{merged}"

    def octal_class_b(self) -> str:
        """Octal first octet + Class B merge (24-bit).
        Example: 0300.11026946"""
        merged = (self.octets[1] << 16) | (self.octets[2] << 8) | self.octets[3]
        return f"0{self.octets[0]:o}.{merged}"

    def hex_octal_class_c(self) -> str:
        """Hex first, octal second + Class C merge.
        Example: 0xC0.0250.16898"""
        merged = (self.octets[2] << 8) | self.octets[3]
        return f"0x{self.octets[0]:X}.0{self.octets[1]:o}.{merged}"

    def octal_hex_class_c(self) -> str:
        """Octal first, hex second + Class C merge.
        Example: 0300.0xA8.16898"""
        merged = (self.octets[2] << 8) | self.octets[3]
        return f"0{self.octets[0]:o}.0x{self.octets[1]:X}.{merged}"

    # =========================================================================
    # MIXED BASE WITH MERGED OCTETS
    # =========================================================================

    def hex_oct_merged_dec(self) -> str:
        """hex.oct.merged-decimal
        Example: 0xC0.0250.16898"""
        merged = (self.octets[2] << 8) | self.octets[3]
        return f"0x{self.octets[0]:X}.0{self.octets[1]:o}.{merged}"

    def hex_dec_merged_hex(self) -> str:
        """hex.dec.merged-hex
        Example: 0xC0.168.0x4202"""
        merged = (self.octets[2] << 8) | self.octets[3]
        return f"0x{self.octets[0]:X}.{self.octets[1]}.0x{merged:X}"

    def oct_hex_merged_oct(self) -> str:
        """oct.hex.merged-octal
        Example: 0300.0xA8.0102002"""
        merged = (self.octets[2] << 8) | self.octets[3]
        return f"0{self.octets[0]:o}.0x{self.octets[1]:X}.0{merged:o}"

    def dec_oct_merged_hex(self) -> str:
        """dec.oct.merged-hex
        Example: 192.0250.0x4202"""
        merged = (self.octets[2] << 8) | self.octets[3]
        return f"{self.octets[0]}.0{self.octets[1]:o}.0x{merged:X}"

    def dec_hex_merged_oct(self) -> str:
        """dec.hex.merged-octal
        Example: 192.0xA8.0102002"""
        merged = (self.octets[2] << 8) | self.octets[3]
        return f"{self.octets[0]}.0x{self.octets[1]:X}.0{merged:o}"

    def oct_dec_merged_hex(self) -> str:
        """oct.dec.merged-hex
        Example: 0300.168.0x4202"""
        merged = (self.octets[2] << 8) | self.octets[3]
        return f"0{self.octets[0]:o}.{self.octets[1]}.0x{merged:X}"

    # =========================================================================
    # CLASS-BASED SHORTHAND (inet_aton compatibility)
    # =========================================================================
    
    def class_a_format(self) -> str:
        """
        Single value (Class A style).
        a -> a.0.0.0 expanded, but here we use full integer.
        Example: 3232235777
        
        Source: inet_aton() man page, BSD sockets
        """
        return str(self.integer)
    
    def class_b_format(self) -> str:
        """
        Two-part notation: a.b (a = first octet, b = 24-bit value).
        Example: 192.168.1.1 -> 192.11010305
        
        inet_aton interprets: a.b where b is 24-bit
        Source: inet_aton() man page
        """
        a = self.octets[0]
        b = (self.octets[1] << 16) | (self.octets[2] << 8) | self.octets[3]
        return f"{a}.{b}"
    
    def class_c_format(self) -> str:
        """
        Three-part notation: a.b.c (c = 16-bit value).
        Example: 192.168.1.1 -> 192.168.257
        
        inet_aton interprets: a.b.c where c is 16-bit
        Source: inet_aton() man page
        """
        a = self.octets[0]
        b = self.octets[1]
        c = (self.octets[2] << 8) | self.octets[3]
        return f"{a}.{b}.{c}"
    
    # =========================================================================
    # IPv6 MAPPED FORMATS
    # =========================================================================
    
    def ipv6_mapped(self) -> str:
        """
        IPv4-mapped IPv6 address (dotted decimal).
        Example: 192.168.1.1 -> ::ffff:192.168.1.1
        
        Source: SANS ISC diary 30466
        """
        return f"::ffff:{self.ip}"
    
    def ipv6_mapped_hex(self) -> str:
        """
        IPv4-mapped IPv6 address (hexadecimal).
        Example: 192.168.1.1 -> ::ffff:c0a8:0101
        
        Used for: URL obfuscation, firewall bypass
        Source: SANS ISC, Cloudflare bug report
        """
        high = (self.octets[0] << 8) | self.octets[1]
        low = (self.octets[2] << 8) | self.octets[3]
        return f"::ffff:{high:x}:{low:x}"
    
    def ipv6_mapped_hex_full(self) -> str:
        """
        Full IPv6 format with mapped address.
        Example: 0000:0000:0000:0000:0000:ffff:c0a8:0101
        """
        high = (self.octets[0] << 8) | self.octets[1]
        low = (self.octets[2] << 8) | self.octets[3]
        return f"0000:0000:0000:0000:0000:ffff:{high:04x}:{low:04x}"
    
    def ipv6_compatible(self) -> str:
        """
        IPv4-compatible IPv6 address (deprecated but may work).
        Example: 192.168.1.1 -> ::192.168.1.1
        """
        return f"::{self.ip}"
    
    def ipv6_compatible_hex(self) -> str:
        """
        IPv4-compatible IPv6 in hex.
        Example: ::c0a8:0101
        """
        high = (self.octets[0] << 8) | self.octets[1]
        low = (self.octets[2] << 8) | self.octets[3]
        return f"::{high:x}:{low:x}"
    
    # =========================================================================
    # OVERFLOW / WRAPAROUND TECHNIQUES
    # =========================================================================
    
    def overflow_dword(self) -> str:
        """
        Add 2^32 to create overflow (may work in some parsers).
        Example: 192.168.1.1 -> 7527203073 (3232235777 + 4294967296)
        
        Source: Webroot (Koobface analysis)
        """
        return str(self.integer + (256 ** 4))
    
    def overflow_octets(self) -> str:
        """
        Add 256 to octets (overflow each byte).
        Example: 192.168.1.1 -> 448.424.257.257
        
        Note: May not work in modern browsers
        """
        return '.'.join(str(o + 256) for o in self.octets)
    
    # =========================================================================
    # URL ENCODING TECHNIQUES
    # =========================================================================

    def url_encoded_decimal(self) -> str:
        """
        URL/percent encode the dotted decimal (all characters).
        Example: 192.168.1.1 -> %31%39%32%2E%31%36%38%2E%31%2E%31
        """
        return ''.join(f'%{ord(c):02X}' for c in str(self.ip))

    def url_encoded_dots_only(self) -> str:
        """
        URL encode only the dots (%2E).
        Example: 192.168.1.1 -> 192%2E168%2E66%2E2
        """
        return str(self.ip).replace('.', '%2E')


    def url_encoded_random(self) -> str:
        """
        Randomly URL encode some characters.
        Example: 1%39%32.16%38.%36%36.2
        """
        result = []
        for c in str(self.ip):
            if c.isdigit() and random.random() > 0.5:
                result.append(f'%{ord(c):02X}')
            else:
                result.append(c)
        return ''.join(result)

    def url_double_encoded(self) -> str:
        """
        Double URL encoding (for WAF bypass).
        Example: 192%252E168%252E66%252E2 (%25 = encoded %)
        """
        # First encode dots, then encode the % sign
        return str(self.ip).replace('.', '%252E')

    def url_unicode_encoded(self) -> str:
        """
        Unicode URL encoding (%u format, legacy IIS).
        Example: 192%u002E168%u002E66%u002E2
        """
        return str(self.ip).replace('.', '%u002E')

    def url_encoded_colons(self) -> str:
        """
        Replace dots with URL-encoded colons (%3A).
        Example: 192%3A168%3A66%3A2
        Note: May work in some parsers that accept : as separator.
        """
        return str(self.ip).replace('.', '%3A')
    
    # =========================================================================
    # URL SCHEMA ABUSE (@ symbol trick)
    # =========================================================================

    def url_with_fake_auth(self, fake_domain: str = "google.com") -> str:
        """
        URL with fake authentication section.
        Example: http://google.com@3232235777

        The part before @ is ignored by browsers.

        Used by: SMOKELOADER, various phishing
        Source: Mandiant "URL Schema Obfuscation"
        """
        return f"http://{fake_domain}@{self.integer}"

    def url_with_fake_auth_hex(self, fake_domain: str = "google.com") -> str:
        """With hex DWORD instead of decimal."""
        return f"http://{fake_domain}@0x{self.integer:x}"

    def url_with_fake_auth_octal(self, fake_domain: str = "google.com") -> str:
        """With octal DWORD instead of decimal."""
        return f"http://{fake_domain}@{self.octal_dword()}"

    def url_with_fake_auth_ipv6(self, fake_domain: str = "google.com") -> str:
        """With IPv6 mapped address."""
        return f"http://{fake_domain}@[{self.ipv6_mapped_hex()}]"

    def url_multi_at(self, fake_domain: str = "google.com", extra: str = "accounts") -> str:
        """
        Multiple @ signs (some parsers take last @).
        Example: http://google.com@accounts@3232235777
        Source: Cuteit
        """
        return f"http://{fake_domain}@{extra}@{self.integer}"

    def url_plus_trick(self, fake_domain: str = "facebook.com", path_fake: str = "settings") -> str:
        """
        Plus sign trick in fake auth.
        Example: https://facebook.com+settings@3232235777
        Source: Cuteit
        """
        return f"https://{fake_domain}+{path_fake}@{self.integer}"

    def url_with_userpass(self, fake_domain: str = "google.com", user: str = "admin", passwd: str = "secure") -> str:
        """
        Full user:pass@host format.
        Example: http://admin:secure@3232235777
        """
        return f"http://{user}:{passwd}@{self.integer}"

    def url_encoded_at(self, fake_domain: str = "google.com") -> str:
        """
        URL-encoded @ symbol (%40).
        Example: http://google.com%403232235777
        Note: Some parsers may not recognize this as auth separator.
        """
        return f"http://{fake_domain}%40{self.integer}"
    
    # =========================================================================
    # LEADING ZEROS PADDING
    # =========================================================================
    
    def decimal_padded(self) -> str:
        """
        Decimal with leading zeros (treated as octal by some parsers!)
        Example: 192.168.001.001
        
        WARNING: Leading zeros = OCTAL in inet_aton!
        Source: SANS ISC
        """
        return '.'.join(f'{o:03d}' for o in self.octets)
    
    def decimal_heavy_padded(self) -> str:
        """Extra heavy zero padding."""
        return '.'.join(f'{o:010d}' for o in self.octets)
    
    # =========================================================================
    # BRACKET FORMATS (for URLs)
    # =========================================================================

    def bracketed_ipv6_mapped(self) -> str:
        """
        Bracketed IPv6 for URL use.
        Example: [::ffff:c0a8:0101]
        """
        return f"[{self.ipv6_mapped_hex()}]"

    def bracketed_ipv6_mapped_decimal(self) -> str:
        """Bracketed with decimal IPv4 portion."""
        return f"[::ffff:{self.ip}]"

    def bracketed_ipv6_full(self) -> str:
        """Bracketed full IPv6."""
        return f"[{self.ipv6_mapped_hex_full()}]"

    def bracketed_url_encoded(self) -> str:
        """
        URL-encoded brackets around IPv6.
        Example: %5B::ffff:c0a8:4202%5D
        """
        return f"%5B{self.ipv6_mapped_hex()}%5D"

    # =========================================================================
    # ADDITIONAL IPv6 FORMATS
    # =========================================================================

    def ipv6_short_zeros(self) -> str:
        """
        IPv6 with explicit zeros (not collapsed).
        Example: 0:0:0:0:0:ffff:c0a8:4202
        """
        high = (self.octets[0] << 8) | self.octets[1]
        low = (self.octets[2] << 8) | self.octets[3]
        return f"0:0:0:0:0:ffff:{high:x}:{low:x}"

    def ipv6_mapped_dword(self) -> str:
        """
        IPv6-mapped with merged DWORD for IPv4 portion.
        Example: ::ffff:c0a84202 (without colon in IPv4 part)
        """
        return f"::ffff:{self.integer:x}"

    # =========================================================================
    # HEX DWORD VARIANTS
    # =========================================================================

    def hex_dword_uppercase_prefix(self) -> str:
        """
        Hex DWORD with uppercase 0X prefix.
        Example: 0XC0A84202
        """
        return f"0X{self.integer:08X}"
    
    # =========================================================================
    # GENERATE ALL FORMATS
    # =========================================================================
    
    def generate_all(self) -> Dict[str, str]:
        """Generate all obfuscation formats."""
        return {
            # Standard
            "Standard Dotted Decimal": self.standard_dotted_decimal(),

            # Integer/DWORD
            "Decimal DWORD": self.decimal_dword(),
            "Hex DWORD (uppercase)": self.hex_dword(),
            "Hex DWORD (lowercase)": self.hex_dword_lowercase(),
            "Hex DWORD (0X prefix)": self.hex_dword_uppercase_prefix(),
            "Octal DWORD": self.octal_dword(),

            # Dotted variants
            "Dotted Hex": self.dotted_hex(),
            "Dotted Hex (lowercase)": self.dotted_hex_lowercase(),
            "Dotted Hex (padded)": self.dotted_hex_padded(),
            "Dotted Hex (long padded)": self.dotted_hex_long_padded(),
            "Dotted Octal": self.dotted_octal(),
            "Dotted Octal (padded)": self.dotted_octal_padded(),
            "Dotted Octal (long padded)": self.dotted_octal_long_padded(),

            # Mixed bases (legacy)
            "Mixed Hex/Decimal": self.mixed_hex_decimal(),
            "Mixed Octal/Decimal": self.mixed_octal_decimal(),
            "Mixed All Bases": self.mixed_all_bases(),
            "Random Mixed": self.random_mixed(),

            # Partial hex conversions
            "Hex First 3": self.hex_first_3(),
            "Hex First 2": self.hex_first_2(),
            "Hex First 1": self.hex_first_1(),
            "Hex Last 3": self.hex_last_3(),
            "Hex Last 2": self.hex_last_2(),
            "Hex Last 1": self.hex_last_1(),

            # Partial octal conversions
            "Octal First 3": self.octal_first_3(),
            "Octal First 2": self.octal_first_2(),
            "Octal First 1": self.octal_first_1(),
            "Octal Last 3": self.octal_last_3(),
            "Octal Last 2": self.octal_last_2(),
            "Octal Last 1": self.octal_last_1(),

            # Partial hex with long padding
            "Hex Padded First 3": self.hex_padded_first_3(),
            "Hex Padded First 2": self.hex_padded_first_2(),
            "Hex Padded First 1": self.hex_padded_first_1(),

            # Partial octal with long padding
            "Octal Padded First 3": self.octal_padded_first_3(),
            "Octal Padded First 2": self.octal_padded_first_2(),
            "Octal Padded First 1": self.octal_padded_first_1(),

            # Three-way base mixing
            "Mix hex.oct.dec.dec": self.mix_hex_oct_dec_dec(),
            "Mix hex.dec.oct.dec": self.mix_hex_dec_oct_dec(),
            "Mix hex.dec.dec.oct": self.mix_hex_dec_dec_oct(),
            "Mix hex.oct.oct.dec": self.mix_hex_oct_oct_dec(),
            "Mix hex.oct.dec.oct": self.mix_hex_oct_dec_oct(),
            "Mix hex.dec.oct.oct": self.mix_hex_dec_oct_oct(),
            "Mix oct.hex.dec.dec": self.mix_oct_hex_dec_dec(),
            "Mix oct.dec.hex.dec": self.mix_oct_dec_hex_dec(),
            "Mix oct.dec.dec.hex": self.mix_oct_dec_dec_hex(),
            "Mix oct.hex.hex.dec": self.mix_oct_hex_hex_dec(),
            "Mix oct.hex.dec.hex": self.mix_oct_hex_dec_hex(),
            "Mix oct.dec.hex.hex": self.mix_oct_dec_hex_hex(),
            "Mix dec.hex.oct.dec": self.mix_dec_hex_oct_dec(),
            "Mix dec.hex.dec.oct": self.mix_dec_hex_dec_oct(),
            "Mix dec.oct.hex.dec": self.mix_dec_oct_hex_dec(),
            "Mix dec.oct.dec.hex": self.mix_dec_oct_dec_hex(),
            "Mix dec.dec.hex.oct": self.mix_dec_dec_hex_oct(),
            "Mix dec.dec.oct.hex": self.mix_dec_dec_oct_hex(),
            "Mix dec.hex.oct.oct": self.mix_dec_hex_oct_oct(),
            "Mix dec.oct.hex.hex": self.mix_dec_oct_hex_hex(),
            "Mix dec.oct.oct.hex": self.mix_dec_oct_oct_hex(),
            "Mix dec.hex.hex.oct": self.mix_dec_hex_hex_oct(),
            "Mix hex.oct.hex.dec": self.mix_hex_oct_hex_dec(),
            "Mix hex.dec.hex.oct": self.mix_hex_dec_hex_oct(),
            "Mix oct.hex.oct.dec": self.mix_oct_hex_oct_dec(),
            "Mix oct.dec.oct.hex": self.mix_oct_dec_oct_hex(),

            # Random padding
            "Random Hex Padding": self.random_hex_padding(),
            "Random Octal Padding": self.random_octal_padding(),
            "Random Mixed Padding": self.random_mixed_padding(),

            # Mixed Class shorthand with hex/octal
            "Hex + Class C": self.hex_class_c(),
            "Hex + Class B": self.hex_class_b(),
            "Octal + Class C": self.octal_class_c(),
            "Octal + Class B": self.octal_class_b(),
            "Hex.Octal + Class C": self.hex_octal_class_c(),
            "Octal.Hex + Class C": self.octal_hex_class_c(),

            # Mixed base with merged octets
            "Hex.Oct.Merged-Dec": self.hex_oct_merged_dec(),
            "Hex.Dec.Merged-Hex": self.hex_dec_merged_hex(),
            "Oct.Hex.Merged-Oct": self.oct_hex_merged_oct(),
            "Dec.Oct.Merged-Hex": self.dec_oct_merged_hex(),
            "Dec.Hex.Merged-Oct": self.dec_hex_merged_oct(),
            "Oct.Dec.Merged-Hex": self.oct_dec_merged_hex(),

            # Class-based shorthand
            "Class B Format (a.bbb)": self.class_b_format(),
            "Class C Format (a.b.cc)": self.class_c_format(),

            # IPv6 mapped
            "IPv6 Mapped (decimal)": self.ipv6_mapped(),
            "IPv6 Mapped (hex)": self.ipv6_mapped_hex(),
            "IPv6 Mapped (full)": self.ipv6_mapped_hex_full(),
            "IPv6 Short Zeros": self.ipv6_short_zeros(),
            "IPv6 Mapped DWORD": self.ipv6_mapped_dword(),
            "IPv6 Compatible": self.ipv6_compatible(),
            "IPv6 Compatible (hex)": self.ipv6_compatible_hex(),

            # Overflow
            "Overflow DWORD (+2^32)": self.overflow_dword(),
            "Overflow Octets (+256)": self.overflow_octets(),

            # URL encoding
            "URL Encoded (full)": self.url_encoded_decimal(),
            "URL Encoded (dots only)": self.url_encoded_dots_only(),
            "URL Encoded (random)": self.url_encoded_random(),
            "URL Double Encoded": self.url_double_encoded(),
            "URL Unicode Encoded": self.url_unicode_encoded(),
            "URL Encoded Colons": self.url_encoded_colons(),

            # URL schema abuse
            "URL Fake Auth (decimal)": self.url_with_fake_auth(),
            "URL Fake Auth (hex)": self.url_with_fake_auth_hex(),
            "URL Fake Auth (octal)": self.url_with_fake_auth_octal(),
            "URL Fake Auth (IPv6)": self.url_with_fake_auth_ipv6(),
            "URL Multi-@": self.url_multi_at(),
            "URL Plus Trick": self.url_plus_trick(),
            "URL User:Pass@Host": self.url_with_userpass(),
            "URL Encoded @": self.url_encoded_at(),

            # Leading zeros
            "Decimal Padded (caution: octal!)": self.decimal_padded(),
            "Decimal Heavy Padded": self.decimal_heavy_padded(),

            # Bracketed
            "Bracketed IPv6 Mapped": self.bracketed_ipv6_mapped(),
            "Bracketed IPv6 Decimal": self.bracketed_ipv6_mapped_decimal(),
            "Bracketed IPv6 Full": self.bracketed_ipv6_full(),
            "Bracketed URL Encoded": self.bracketed_url_encoded(),
        }
    
    def generate_urls(self, path: str = "/") -> Dict[str, str]:
        """Generate URL versions of all formats."""
        urls = {}
        formats = self.generate_all()
        
        for name, value in formats.items():
            if value.startswith("http"):
                urls[name] = value + path
            elif value.startswith("["):
                urls[name] = f"http://{value}{path}"
            elif "::" in value:
                urls[name] = f"http://[{value}]{path}"
            else:
                urls[name] = f"http://{value}{path}"
        
        return urls


def generate_obfuscated_urls(
    ip: str,
    fake_domain: str = "google.com",
    path: str = "/",
    port: Optional[int] = None,
    fake_password: Optional[str] = None,
    use_https: bool = False,
) -> Dict[str, str]:
    """
    Generate all possible obfuscated URL combinations.

    Args:
        ip: Target IPv4 address (e.g., "193.24.210.101")
        fake_domain: Fake domain to show before @ (e.g., "secure.bank.com")
        path: Path to request on target server (e.g., "/account/login")
        port: Optional port number (e.g., 8080)
        fake_password: Optional fake password for user:pass@host format
        use_https: Use HTTPS instead of HTTP

    Returns:
        Dictionary of technique names to obfuscated URLs
    """
    obf = IPObfuscator(ip)
    urls = {}
    proto = "https" if use_https else "http"

    # Ensure path starts with /
    if not path.startswith("/"):
        path = "/" + path

    # Build port string
    port_str = f":{port}" if port else ""

    # Build auth string
    if fake_password:
        auth = f"{fake_domain}:{fake_password}@"
    else:
        auth = f"{fake_domain}@"

    # =========================================================================
    # NO OBFUSCATION (baseline)
    # =========================================================================
    urls["Standard (no obfuscation)"] = f"{proto}://{ip}{port_str}{path}"
    
    # =========================================================================
    # IP-ONLY OBFUSCATION (no fake auth)
    # =========================================================================

    # Integer/DWORD formats
    urls["Decimal DWORD"] = f"{proto}://{obf.decimal_dword()}{port_str}{path}"
    urls["Hex DWORD"] = f"{proto}://{obf.hex_dword()}{port_str}{path}"
    urls["Hex DWORD (lowercase)"] = f"{proto}://{obf.hex_dword_lowercase()}{port_str}{path}"
    urls["Hex DWORD (0X prefix)"] = f"{proto}://{obf.hex_dword_uppercase_prefix()}{port_str}{path}"
    urls["Octal DWORD"] = f"{proto}://{obf.octal_dword()}{port_str}{path}"

    # Dotted formats
    urls["Dotted Hex"] = f"{proto}://{obf.dotted_hex()}{port_str}{path}"
    urls["Dotted Hex (lowercase)"] = f"{proto}://{obf.dotted_hex_lowercase()}{port_str}{path}"
    urls["Dotted Hex (long pad)"] = f"{proto}://{obf.dotted_hex_long_padded()}{port_str}{path}"
    urls["Dotted Octal"] = f"{proto}://{obf.dotted_octal()}{port_str}{path}"
    urls["Dotted Octal (padded)"] = f"{proto}://{obf.dotted_octal_padded()}{port_str}{path}"
    urls["Dotted Octal (long pad)"] = f"{proto}://{obf.dotted_octal_long_padded()}{port_str}{path}"

    # Partial hex conversions
    urls["Hex First 3"] = f"{proto}://{obf.hex_first_3()}{port_str}{path}"
    urls["Hex First 2"] = f"{proto}://{obf.hex_first_2()}{port_str}{path}"
    urls["Hex First 1"] = f"{proto}://{obf.hex_first_1()}{port_str}{path}"
    urls["Hex Last 3"] = f"{proto}://{obf.hex_last_3()}{port_str}{path}"
    urls["Hex Last 2"] = f"{proto}://{obf.hex_last_2()}{port_str}{path}"
    urls["Hex Last 1"] = f"{proto}://{obf.hex_last_1()}{port_str}{path}"

    # Partial octal conversions
    urls["Octal First 3"] = f"{proto}://{obf.octal_first_3()}{port_str}{path}"
    urls["Octal First 2"] = f"{proto}://{obf.octal_first_2()}{port_str}{path}"
    urls["Octal First 1"] = f"{proto}://{obf.octal_first_1()}{port_str}{path}"
    urls["Octal Last 3"] = f"{proto}://{obf.octal_last_3()}{port_str}{path}"
    urls["Octal Last 2"] = f"{proto}://{obf.octal_last_2()}{port_str}{path}"
    urls["Octal Last 1"] = f"{proto}://{obf.octal_last_1()}{port_str}{path}"

    # Mixed formats
    urls["Mixed Hex/Decimal"] = f"{proto}://{obf.mixed_hex_decimal()}{port_str}{path}"
    urls["Mixed Octal/Decimal"] = f"{proto}://{obf.mixed_octal_decimal()}{port_str}{path}"
    urls["Mixed All Bases"] = f"{proto}://{obf.mixed_all_bases()}{port_str}{path}"

    # Class shorthand
    urls["Class B Format"] = f"{proto}://{obf.class_b_format()}{port_str}{path}"
    urls["Class C Format"] = f"{proto}://{obf.class_c_format()}{port_str}{path}"

    # Mixed Class shorthand with hex/octal
    urls["Hex + Class C"] = f"{proto}://{obf.hex_class_c()}{port_str}{path}"
    urls["Hex + Class B"] = f"{proto}://{obf.hex_class_b()}{port_str}{path}"
    urls["Octal + Class C"] = f"{proto}://{obf.octal_class_c()}{port_str}{path}"
    urls["Octal + Class B"] = f"{proto}://{obf.octal_class_b()}{port_str}{path}"

    # IPv6 formats (need brackets)
    urls["IPv6 Mapped (decimal)"] = f"{proto}://[{obf.ipv6_mapped()}]{port_str}{path}"
    urls["IPv6 Mapped (hex)"] = f"{proto}://[{obf.ipv6_mapped_hex()}]{port_str}{path}"
    urls["IPv6 Mapped (full)"] = f"{proto}://[{obf.ipv6_mapped_hex_full()}]{port_str}{path}"
    urls["IPv6 Short Zeros"] = f"{proto}://[{obf.ipv6_short_zeros()}]{port_str}{path}"

    # Overflow
    urls["Overflow DWORD"] = f"{proto}://{obf.overflow_dword()}{port_str}{path}"

    # =========================================================================
    # WITH FAKE AUTH (@ trick)
    # =========================================================================

    # Integer/DWORD + fake auth
    urls["Fake Auth + Decimal DWORD"] = f"{proto}://{auth}{obf.decimal_dword()}{port_str}{path}"
    urls["Fake Auth + Hex DWORD"] = f"{proto}://{auth}{obf.hex_dword_lowercase()}{port_str}{path}"
    urls["Fake Auth + Octal DWORD"] = f"{proto}://{auth}{obf.octal_dword()}{port_str}{path}"

    # Dotted + fake auth
    urls["Fake Auth + Dotted Hex"] = f"{proto}://{auth}{obf.dotted_hex_lowercase()}{port_str}{path}"
    urls["Fake Auth + Dotted Octal"] = f"{proto}://{auth}{obf.dotted_octal()}{port_str}{path}"

    # IPv6 + fake auth
    urls["Fake Auth + IPv6 Mapped (hex)"] = f"{proto}://{auth}[{obf.ipv6_mapped_hex()}]{port_str}{path}"
    urls["Fake Auth + IPv6 Mapped (decimal)"] = f"{proto}://{auth}[{obf.ipv6_mapped()}]{port_str}{path}"
    urls["Fake Auth + IPv6 Mapped (full)"] = f"{proto}://{auth}[{obf.ipv6_mapped_hex_full()}]{port_str}{path}"

    # Class shorthand + fake auth
    urls["Fake Auth + Class B"] = f"{proto}://{auth}{obf.class_b_format()}{port_str}{path}"
    urls["Fake Auth + Class C"] = f"{proto}://{auth}{obf.class_c_format()}{port_str}{path}"

    # =========================================================================
    # WITH URL-ENCODED PATH
    # =========================================================================

    encoded_path = ''.join(f'%{ord(c):02X}' if c != '/' else c for c in path)

    urls["IPv6 + Encoded Path"] = f"{proto}://[{obf.ipv6_mapped_hex()}]{port_str}{encoded_path}"
    urls["Fake Auth + IPv6 + Encoded Path"] = f"{proto}://{auth}[{obf.ipv6_mapped_hex()}]{port_str}{encoded_path}"
    urls["Fake Auth + DWORD + Encoded Path"] = f"{proto}://{auth}{obf.decimal_dword()}{port_str}{encoded_path}"

    # =========================================================================
    # MAXIMUM OBFUSCATION COMBOS
    # =========================================================================

    # Encode path characters but keep / unencoded (required for URL to work)
    max_encoded_path = ''.join(f'%{ord(c):02X}' if c != '/' else c for c in path)
    urls["Max Obfuscation (IPv6)"] = f"{proto}://{auth}[{obf.ipv6_mapped_hex()}]{port_str}{max_encoded_path}"
    urls["Max Obfuscation (DWORD)"] = f"{proto}://{auth}{obf.decimal_dword()}{port_str}{max_encoded_path}"
    urls["Max Obfuscation (Octal)"] = f"{proto}://{auth}{obf.dotted_octal_padded()}{port_str}{max_encoded_path}"

    return urls


def analyze_security_zones(ip: str) -> Dict[str, Dict]:
    """
    Analyze which IP obfuscation formats would be treated as Local Intranet Zone
    vs Internet Zone by Microsoft Windows/IE security zones.
    
    The "Dot Rule" (PlainHostName rule):
    - Hostnames WITHOUT dots → Local Intranet Zone (relaxed security)
    - Hostnames WITH dots    → Internet Zone (stricter security)
    """
    obf = IPObfuscator(ip)
    
    # Categorize formats by whether they contain dots
    # Key insight: It's specifically about dots in the hostname
    
    formats = {
        # Dotless formats (DANGEROUS - trigger Intranet Zone)
        "dotless": [
            ("Decimal DWORD", obf.decimal_dword(),
             "CONFIRMED: MS98-016 specifically documents this as Intranet Zone bypass"),
            ("Hex DWORD (0x prefix)", obf.hex_dword(),
             "CONFIRMED: Numeric hostname without dots → Intranet Zone"),
            ("Hex DWORD (lowercase)", obf.hex_dword_lowercase(),
             "Same as above, just lowercase"),
            ("Octal DWORD", obf.octal_dword(),
             "Octal integer without dots → Intranet Zone"),
            ("Overflow DWORD (+2^32)", obf.overflow_dword(),
             "Still numeric, still dotless → Intranet Zone"),
        ],
        
        # Dotted formats (Safe - stay in Internet Zone)
        "dotted": [
            ("Standard Dotted Decimal", obf.standard_dotted_decimal(),
             "Contains dots → Internet Zone"),
            ("Dotted Hex", obf.dotted_hex(),
             "Contains dots between octets → Internet Zone"),
            ("Dotted Hex (padded)", obf.dotted_hex_long_padded(),
             "Still has dots → Internet Zone"),
            ("Dotted Octal", obf.dotted_octal(),
             "Contains dots → Internet Zone"),
            ("Dotted Octal (padded)", obf.dotted_octal_padded(),
             "Contains dots → Internet Zone"),
            ("Mixed Hex/Decimal", obf.mixed_hex_decimal(),
             "Contains dots → Internet Zone"),
            ("Mixed Octal/Decimal", obf.mixed_octal_decimal(),
             "Contains dots → Internet Zone"),
            ("Class B Format (a.bbb)", obf.class_b_format(),
             "Contains 1 dot → Internet Zone"),
            ("Class C Format (a.b.cc)", obf.class_c_format(),
             "Contains 2 dots → Internet Zone"),
        ],
        
        # IPv6 formats (Special handling - varies by browser/version)
        "ipv6": [
            ("IPv6 Mapped (hex)", f"[{obf.ipv6_mapped_hex()}]",
             "Bracketed IPv6 - Modern browsers: Internet Zone. Older IE: may vary"),
            ("IPv6 Mapped (decimal)", f"[{obf.ipv6_mapped()}]",
             "Contains dots inside brackets - likely Internet Zone"),
            ("IPv6 Mapped (full)", f"[{obf.ipv6_mapped_hex_full()}]",
             "Full IPv6 notation - Modern browsers handle correctly"),
        ],
    }
    
    return formats


def print_security_zone_analysis(ip: str) -> Dict[str, list]:
    """Print security zone analysis for an IP address."""
    results = analyze_security_zones(ip)
    
    print("=" * 80)
    print("MICROSOFT SECURITY ZONES ANALYSIS")
    print("=" * 80)
    print()
    print("The 'Dot Rule' (PlainHostName rule):")
    print("  • Hostname WITHOUT dots → Local Intranet Zone")
    print("  • Hostname WITH dots    → Internet Zone")
    print()
    print()
    print("⚠️  SECURITY IMPACT of Intranet Zone:")
    print("  • Automatic NTLM/Kerberos credential release (credential theft!)")
    print("  • Less restrictive ActiveX/script policies")
    print("  • Utilize with WebDav/Relay")
    print()
    print("=" * 80)
    print(f"Target IP: {ip}")
    print("=" * 80)
    
    # Dotless (dangerous)
    print()
    print("🔴 DOTLESS → LOCAL INTRANET ZONE (HIGH RISK - credential leak)")
    print("-" * 80)
    for name, value, note in results["dotless"]:
        print(f"  {name}")
        print(f"    URL: http://{value}/")
        print(f"    Note: {note}")
        print()
    
    # Dotted (safe)
    print()
    print("🟢 DOTTED → INTERNET ZONE (normal security)")
    print("-" * 80)
    for name, value, note in results["dotted"]:
        print(f"  {name}")
        print(f"    URL: http://{value}/")
        print()
    
    print("=" * 80)
    print("SUMMARY:")
    print(f"  🔴 {len(results['dotless'])} formats trigger Intranet Zone (credential leak risk)")
    print(f"  🟢 {len(results['dotted'])} formats stay in Internet Zone (safe)")
    print()
    print("=" * 80)
    
    return results


def print_obfuscated_urls(
    ip: str,
    fake_domain: str = "google.com",
    path: str = "/",
    port: Optional[int] = None,
    fake_password: Optional[str] = None,
    use_https: bool = False,
    filter_pattern: Optional[str] = None,
) -> Dict[str, str]:
    """Print all obfuscated URLs in a formatted way."""

    urls = generate_obfuscated_urls(ip, fake_domain, path, port, fake_password, use_https)

    # Apply filter if specified
    if filter_pattern:
        filter_lower = filter_pattern.lower()
        urls = {k: v for k, v in urls.items() if filter_lower in k.lower() or filter_lower in v.lower()}
    
    print("=" * 80)
    print("OBFUSCATED URL GENERATOR")
    print("=" * 80)
    print(f"  Target IP:     {ip}")
    print(f"  Fake Domain:   {fake_domain}")
    print(f"  Fake Password: {fake_password or '(none)'}")
    print(f"  Port:          {port or '(default)'}")
    print(f"  Path:          {path}")
    print(f"  Protocol:      {'HTTPS' if use_https else 'HTTP'}")
    if filter_pattern:
        print(f"  Filter:        {filter_pattern}")
    print("=" * 80)
    
    # Group URLs - print all URLs that exist
    categories = {
        "DWORD/INTEGER FORMATS": [
            "Standard (no obfuscation)",
            "Decimal DWORD", "Hex DWORD", "Hex DWORD (lowercase)", "Hex DWORD (0X prefix)", "Octal DWORD",
            "Overflow DWORD",
        ],
        "DOTTED FORMATS": [
            "Dotted Hex", "Dotted Hex (lowercase)", "Dotted Hex (long pad)",
            "Dotted Octal", "Dotted Octal (padded)", "Dotted Octal (long pad)",
        ],
        "PARTIAL HEX CONVERSIONS": [
            "Hex First 3", "Hex First 2", "Hex First 1",
            "Hex Last 3", "Hex Last 2", "Hex Last 1",
        ],
        "PARTIAL OCTAL CONVERSIONS": [
            "Octal First 3", "Octal First 2", "Octal First 1",
            "Octal Last 3", "Octal Last 2", "Octal Last 1",
        ],
        "MIXED FORMATS": [
            "Mixed Hex/Decimal", "Mixed Octal/Decimal", "Mixed All Bases",
        ],
        "CLASS SHORTHAND": [
            "Class B Format", "Class C Format",
            "Hex + Class C", "Hex + Class B",
            "Octal + Class C", "Octal + Class B",
        ],
        "IPv6 FORMATS": [
            "IPv6 Mapped (decimal)", "IPv6 Mapped (hex)", "IPv6 Mapped (full)", "IPv6 Short Zeros",
        ],
        "WITH FAKE AUTH (@ trick)": [
            "Fake Auth + Decimal DWORD", "Fake Auth + Hex DWORD", "Fake Auth + Octal DWORD",
            "Fake Auth + Dotted Hex", "Fake Auth + Dotted Octal",
            "Fake Auth + IPv6 Mapped (hex)", "Fake Auth + IPv6 Mapped (decimal)", "Fake Auth + IPv6 Mapped (full)",
            "Fake Auth + Class B", "Fake Auth + Class C",
        ],
        "WITH ENCODED PATH": [
            "IPv6 + Encoded Path",
            "Fake Auth + IPv6 + Encoded Path",
            "Fake Auth + DWORD + Encoded Path",
        ],
        "MAXIMUM OBFUSCATION": [
            "Max Obfuscation (IPv6)",
            "Max Obfuscation (DWORD)",
            "Max Obfuscation (Octal)",
        ],
    }
    
    for category, keys in categories.items():
        print(f"\n{category}")
        print("-" * 80)
        for key in keys:
            if key in urls:
                print(f"\n  {key}:")
                print(f"  {urls[key]}")
    
    print("\n" + "=" * 80)
    print(f"Total variations generated: {len(urls)}")
    print("=" * 80)
    
    return urls


def decode_obfuscated_ip(obfuscated: str) -> str:
    """
    Attempt to decode an obfuscated IP address back to standard form.
    Handles most common obfuscation techniques.
    """
    import re
    
    original = obfuscated
    
    # Remove URL components
    obfuscated = obfuscated.strip()
    if "://" in obfuscated:
        obfuscated = obfuscated.split("://")[1]
    if "@" in obfuscated:
        obfuscated = obfuscated.split("@")[-1]
    if "/" in obfuscated:
        obfuscated = obfuscated.split("/")[0]
    
    # Handle bracketed IPv6 with port: [::ffff:c118:d265]:8080
    if obfuscated.startswith("["):
        # Find the closing bracket
        bracket_end = obfuscated.find("]")
        if bracket_end != -1:
            obfuscated = obfuscated[1:bracket_end]  # Extract just the IPv6 part
    
    # Handle IPv6 mapped addresses
    if obfuscated.lower().startswith("::ffff:"):
        ipv4_part = obfuscated[7:]
        
        if "." in ipv4_part:
            # Decimal format like ::ffff:192.168.1.1
            return ipv4_part
        elif ":" in ipv4_part:
            # Hex format like c0a8:0101
            parts = ipv4_part.split(":")
            if len(parts) == 2:
                try:
                    high = int(parts[0], 16)
                    low = int(parts[1], 16)
                    return f"{high >> 8}.{high & 0xFF}.{low >> 8}.{low & 0xFF}"
                except ValueError:
                    pass
        else:
            # Compact hex without colon
            try:
                val = int(ipv4_part, 16)
                return str(ipaddress.IPv4Address(val))
            except:
                pass
    
    # Handle IPv6 compatible addresses (::x.x.x.x or ::xxxx:xxxx)
    if obfuscated.startswith("::") and not obfuscated.lower().startswith("::ffff:"):
        ipv4_part = obfuscated[2:]
        if "." in ipv4_part:
            return ipv4_part
        elif ":" in ipv4_part:
            parts = ipv4_part.split(":")
            if len(parts) == 2:
                try:
                    high = int(parts[0], 16)
                    low = int(parts[1], 16)
                    return f"{high >> 8}.{high & 0xFF}.{low >> 8}.{low & 0xFF}"
                except ValueError:
                    pass
    
    # Remove port from non-IPv6 addresses
    if ":" in obfuscated and not obfuscated.startswith(":"):
        # Check if this looks like ip:port
        parts = obfuscated.rsplit(":", 1)
        if len(parts) == 2 and parts[1].isdigit():
            obfuscated = parts[0]
    
    # Handle octal DWORD (starts with 0, all digits are 0-7)
    if obfuscated.startswith("0") and len(obfuscated) > 1 and "." not in obfuscated:
        if all(c in "01234567" for c in obfuscated):
            try:
                val = int(obfuscated, 8)
                if val > 0xFFFFFFFF:
                    val = val % (256 ** 4)
                return str(ipaddress.IPv4Address(val))
            except:
                pass

    # Handle pure decimal (DWORD)
    if obfuscated.isdigit():
        val = int(obfuscated)
        if val > 0xFFFFFFFF:
            val = val % (256 ** 4)  # Handle overflow
        return str(ipaddress.IPv4Address(val))

    # Handle hex DWORD
    if obfuscated.lower().startswith("0x") and "." not in obfuscated:
        try:
            val = int(obfuscated, 16)
            return str(ipaddress.IPv4Address(val))
        except:
            pass
    
    # Handle dotted formats (may have mixed hex/octal/decimal)
    if "." in obfuscated:
        parts = obfuscated.split(".")
        octets = []
        
        for part in parts:
            part = part.strip()
            
            try:
                if part.lower().startswith("0x"):
                    octets.append(int(part, 16))
                elif part.startswith("0") and len(part) > 1 and all(c in "01234567" for c in part):
                    # Octal
                    octets.append(int(part, 8))
                else:
                    octets.append(int(part))
            except ValueError:
                return f"Unable to decode: {original}"
        
        # Handle class B/C shorthand
        if len(octets) == 2:
            # a.b format (b is 24-bit)
            return f"{octets[0]}.{(octets[1] >> 16) & 0xFF}.{(octets[1] >> 8) & 0xFF}.{octets[1] & 0xFF}"
        elif len(octets) == 3:
            # a.b.c format (c is 16-bit)
            return f"{octets[0]}.{octets[1]}.{(octets[2] >> 8) & 0xFF}.{octets[2] & 0xFF}"
        elif len(octets) == 4:
            # Handle overflow in octets
            octets = [o % 256 for o in octets]
            return '.'.join(str(o) for o in octets)
    
    return f"Unable to decode: {original}"


def print_demo(ip_str: str = "193.24.210.101") -> None:
    """Print a demonstration of all obfuscation techniques."""
    print("=" * 80)
    print(f"IP Address Obfuscation Demo: {ip_str}")
    print("=" * 80)
    
    obf = IPObfuscator(ip_str)
    formats = obf.generate_all()
    
    # Group by category
    categories = {
        "STANDARD": ["Standard Dotted Decimal"],
        "INTEGER/DWORD": ["Decimal DWORD", "Hex DWORD (uppercase)", "Hex DWORD (lowercase)", "Octal DWORD"],
        "DOTTED HEX": ["Dotted Hex", "Dotted Hex (lowercase)", "Dotted Hex (padded)", "Dotted Hex (long padded)"],
        "DOTTED OCTAL": ["Dotted Octal", "Dotted Octal (padded)", "Dotted Octal (long padded)"],
        "MIXED NOTATION": ["Mixed Hex/Decimal", "Mixed Octal/Decimal", "Mixed All Bases", "Random Mixed"],
        "CLASS SHORTHAND": ["Class B Format (a.bbb)", "Class C Format (a.b.cc)"],
        "IPv6 MAPPED": ["IPv6 Mapped (decimal)", "IPv6 Mapped (hex)", "IPv6 Mapped (full)", 
                        "IPv6 Compatible", "IPv6 Compatible (hex)"],
        "OVERFLOW": ["Overflow DWORD (+2^32)", "Overflow Octets (+256)"],
        "URL ENCODING": ["URL Encoded (full)", "URL Encoded (dots only)", "URL Encoded (all hex)"],
        "URL SCHEMA ABUSE": ["URL Fake Auth (decimal)", "URL Fake Auth (hex)", "URL Fake Auth (IPv6)"],
        "PADDING": ["Decimal Padded (caution: octal!)", "Decimal Heavy Padded"],
        "BRACKETED": ["Bracketed IPv6 Mapped", "Bracketed IPv6 Decimal"],
    }
    
    for category, keys in categories.items():
        print(f"\n{category}")
        print("-" * 40)
        for key in keys:
            if key in formats:
                print(f"  {key}:")
                print(f"    {formats[key]}")
    
    print("\n" + "=" * 80)
    print("URL EXAMPLES")
    print("=" * 80)
    
    urls = obf.generate_urls("/path/to/page")
    sample_urls = [
        "Decimal DWORD",
        "Dotted Hex",
        "Dotted Octal",
        "IPv6 Mapped (hex)",
        "URL Fake Auth (decimal)",
        "Bracketed IPv6 Mapped",
    ]
    
    for name in sample_urls:
        if name in urls:
            print(f"\n{name}:")
            print(f"  {urls[name]}")


def main() -> None:
    import argparse

    parser = argparse.ArgumentParser(
        description="IP Address Obfuscation Tool - Generate obfuscated URLs",
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog="""
Examples:
  %(prog)s 192.168.1.1
  %(prog)s 192.168.1.1 --url
  %(prog)s 192.168.1.1 --url --fake-domain secure.bank.com --path /login
  %(prog)s 192.168.1.1 --url --fake-domain paypal.com --fake-pass 443 --path /account --port 8080
  %(prog)s 192.168.1.1 --url --https  # Generate HTTPS URLs
  %(prog)s 192.168.1.1 --url --filter ipv6  # Filter results containing 'ipv6'
  %(prog)s 192.168.1.1 --url --json  # Output as JSON
  %(prog)s 192.168.1.1 --zones  # Check which formats bypass IE security zones
  %(prog)s --decode "http://google.com@3232235777/admin"
  %(prog)s --decode "::ffff:c0a8:101"
        """
    )

    parser.add_argument("ip", nargs="?", default="193.24.210.101",
                        help="IPv4 address to obfuscate (default: 193.24.210.101)")
    parser.add_argument("--url", "-u", action="store_true",
                        help="Generate obfuscated URLs (with fake domain support)")
    parser.add_argument("--fake-domain", "-f", default="google.com",
                        help="Fake domain for @ trick (default: google.com)")
    parser.add_argument("--fake-pass", "-w", default=None,
                        help="Fake password for user:pass@host format")
    parser.add_argument("--path", "-p", default="/",
                        help="Path to append to URLs (default: /)")
    parser.add_argument("--port", "-P", type=int, default=None,
                        help="Port number (default: none)")
    parser.add_argument("--https", "-s", action="store_true",
                        help="Use HTTPS instead of HTTP")
    parser.add_argument("--decode", "-d", default=None,
                        help="Decode an obfuscated IP/URL back to standard form")
    parser.add_argument("--list", "-l", action="store_true",
                        help="Just list all obfuscated forms (compact output)")
    parser.add_argument("--zones", "-z", action="store_true",
                        help="Analyze which formats trigger Local Intranet Zone (security bypass)")
    parser.add_argument("--json", "-j", action="store_true",
                        help="Output results as JSON")
    parser.add_argument("--filter", "-F", default=None,
                        help="Filter results by keyword (case-insensitive)")

    args = parser.parse_args()

    # Decode mode
    if args.decode:
        decoded = decode_obfuscated_ip(args.decode)
        if args.json:
            print(json.dumps({"input": args.decode, "decoded": decoded}, indent=2))
        else:
            print(f"Input:   {args.decode}")
            print(f"Decoded: {decoded}")
        return

    # Security zones analysis mode
    if args.zones:
        if args.json:
            results = analyze_security_zones(args.ip)
            print(json.dumps(results, indent=2))
        else:
            print_security_zone_analysis(args.ip)
        return

    # URL generation mode
    if args.url:
        if args.json:
            urls = generate_obfuscated_urls(
                ip=args.ip,
                fake_domain=args.fake_domain,
                path=args.path,
                port=args.port,
                fake_password=args.fake_pass,
                use_https=args.https,
            )
            # Apply filter if specified
            if args.filter:
                filter_lower = args.filter.lower()
                urls = {k: v for k, v in urls.items() if filter_lower in k.lower() or filter_lower in v.lower()}
            print(json.dumps(urls, indent=2))
        else:
            print_obfuscated_urls(
                ip=args.ip,
                fake_domain=args.fake_domain,
                path=args.path,
                port=args.port,
                fake_password=args.fake_pass,
                use_https=args.https,
                filter_pattern=args.filter,
            )
        return

    # Compact list mode
    if args.list:
        obf = IPObfuscator(args.ip)
        formats = obf.generate_all()
        # Apply filter if specified
        if args.filter:
            filter_lower = args.filter.lower()
            formats = {k: v for k, v in formats.items() if filter_lower in k.lower() or filter_lower in v.lower()}
        if args.json:
            print(json.dumps(formats, indent=2))
        else:
            print(f"All obfuscated forms of {args.ip}:\n")
            for name, value in formats.items():
                print(f"  {value}")
        return

    # Default: full demo (or JSON output of all formats)
    if args.json:
        obf = IPObfuscator(args.ip)
        formats = obf.generate_all()
        if args.filter:
            filter_lower = args.filter.lower()
            formats = {k: v for k, v in formats.items() if filter_lower in k.lower() or filter_lower in v.lower()}
        print(json.dumps(formats, indent=2))
        return

    print_demo(args.ip)
    
    print("\n" + "=" * 80)
    print("DECODER TEST")
    print("=" * 80)
    
    obf = IPObfuscator(args.ip)
    test_cases = [
        obf.decimal_dword(),
        obf.hex_dword(),
        obf.dotted_hex(),
        obf.dotted_octal(),
        obf.class_c_format(),
        obf.ipv6_mapped_hex(),
        f"http://google.com@{obf.decimal_dword()}/path",
        obf.overflow_dword(),
    ]
    
    print(f"\nDecoding back to standard format:")
    for test in test_cases:
        decoded = decode_obfuscated_ip(test)
        status = "✓" if decoded == args.ip else "?"
        print(f"  {status} {test[:50]:<50} -> {decoded}")
    
    print("\n" + "=" * 80)
    print("TIP: Use --url to generate full obfuscated URLs with fake domains")
    print("     Example: python3 ip_obfuscator.py 192.168.1.1 --url --fake-domain bank.com --path /login")
    print("=" * 80)


if __name__ == "__main__":
    main()