2

I am looking for a generic tool or library that would take an HTML file and randomly shuffle and rewrite it to create a new HTML file with a different DOM structure but that would visually render in the same way as an original HTML file.

I don't want to use javascript, the result should be crawler friendly.

Take an input HTML, produce an output HTML that would render in a similar fashion as the original but would have a different dom structure, padded with empty hidden tables, paragraphs, different divs, etc. The purpose is obfuscation to make writing parsers and extracting the structured data more difficult.

For example:

<html>
<body>
<table>
<tr>
<th>Name</th>
<th>Phone</th>
</tr>
<tr>
<td>Scott</td>
<td>555-3333</td>
</tr>
</table>
</body>
</html>

Could become as an example of a single run (one random incarnation)

<html>
<body>
<div>
<table>
<tr>
<th></th>
<th></th>
</tr>
</table>
<div><div><div>
<table>
<div>
<tr>
<th>Name<div></div><div></div></th>
<th>Phone<div></div></th>
</tr>
</div>
<tr>
<td>Scott</td>
<td>555-3333</td>
</tr>
</table>
</div></div></div>
</div>
</body>
</html>
3
  • 3
    LOL :-) Nice request. To suggest a library, we'd need to know for which OS and potentially which programming language. Perhaps you also want to require a license (commercial use?, no GPL or other viral open source license perhaps?) and a price. – Thomas Weller Aug 24 '16 at 13:40
  • 1
    Seems pointless to me. Why would I parse your HTML when I could just load it into a PhantomJS headless-webkit-browser and troll the DOM. You can't hide yer dom. – Warren P Aug 24 '16 at 16:48
  • No problem, read the DOM, but to parse the structured data you need to find it. Is it in the first table, the second table, first div, second div. – Pripukus Aug 24 '16 at 18:30
1

What you want is a Program Transformation System (PTS). These are tools that read source code, build compiler data structures representing the code, allow you to apply code transforms to the compiler data structures, and then regenerate source code according to the modified data structure. Ideally, the PTS can be obtained with parsers and prettyprinters (the parser inverse) for the language of interest (in this case, HTML).

A good PTS will let you write code transforms using the surface syntax of the programming langauge being processed in this form:

 when you see <this pattern>, replace it by <that pattern> if <condition>

What you want to write for OP's purpose are transformations that preserve the language semantics (of HTML). Such transformations are like algebraic identity operations, e.g, "x rewrites to x+0" which is equivalent but harder to understand.

Our DMS Software Reengineering Toolkit can do this for HTML (and has parsers that can handle the dirty HTML that browsers accept). You can see the syntax for rules here.

An example rule might be:

 rule insert_div(text: TEXT): P -> P =
     " <P>\text</P> " ->
     " <P>\firstthird\(\text\)<div>\middlethird\(\text\)</div>\lastthird\(\text\)</P> ";

This rule matches up a Paragraph containing only text, and replaces it by a paragraph with block wrapped around the middle third of the text. (Somebody has to code custom metaprocedures firstthird, middlethird, lastthird, but these a pretty trivial substring operations).

One can write lots of rules like this (and more complex ones) that preserve the semantics along the lines the OP suggested. Then to scramble the code, you simply repeated randomly choose among the rules you have built and apply them. After enough applications, you spill the transformed code back out. Voila. Now an actual Dom for the HTML document will be the mess that OP hoped for.

Now, any algebraic identity has, of course, and inverse, e.g., "x+0 rewrites to x". So for any (useless) HTML tags (such as the pointless we inserted above, one can write transform rules that would remove them. So if were an attacker, I'd write inverse rules an apply them to eliminate all the pointless tags, and then I'd process the resulting (clean) file in the way the OP was hoping to avoid. Thus, the same tool that can scramble the code, can be used to unscramble it. You have to hope the attacker isn't as clever as you. [Good ones probably are].

Summary:

  • DMS Software Reengineering Toolkit can do this to HTML, provided you define a set to HTML-preserving but complexifying/obfuscating transforms
  • It runs on Windows, and on Linux under Wine
  • It can be used to undo the "opfuscation" by writing inverse simplification rules. You might have to inspect the obfuscated version to find out what to do, and depending on the creativity of the obfuscation transform writer, it might take awhile to figure what the inverse rules are. I suspect that after a few hundred, you probably have all the simplification rules that apply to HTML.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.