🔍 ZWSP-Tool

About ZWSP Toolkit

ZWSP-Tool is a powerful toolkit that allows to manipulate 
zero width spaces quickly and easily. ZWSP-Tool allows in 
particular to detect, clean, hide, extract and bruteforce 
a text containing zero width spaces.

📥 Installation

Clone the repository :

$ git clone https://github.com/TwistAtom/ZWSP-Tool.git

Move in the folder :

$ cd ZWSP-Tool

Add the execution right to the installation file :

$ chmod +x install.sh

Finally, run the installation file :

$ ./install.sh

🚀 Launch

After installation, you can now launch the ZWSP toolkit from anywhere by typing :

$ zwsp-tool

❌ Uninstallation

$ cd ZWSP-Tool
$ ./uninstall.sh

⚙️ Options

Clean module

Parameter	Type	Format	Default	Note
`-i`, `--ignore`	`string`	`"<char_1>, <char_2>, ..."`		Ignore characters.
`-s`, `--specific`	`string`	`"<char_1>, <char_2>, ..."`		Clean specific characters.

Detect module

Parameter	Type	Format	Default	Note
`-i`, `--ignore`	`string`	`"<char_1>, <char_2>, ..."`		Ignore characters.
`-r`, `--replace`	`string`	{`dotted`, `escaped`, `named`}	`dotted`	Character replacing zero width spaces.
`-s`, `--search`	`string`	`"<char_1>, <char_2>, ..."`		Search characters.

Embed module

Parameter	Type	Format	Default	Note
`-c`, `--characters`	`string`	`"<char_1>, <char_2>, ..."`	`('\u200b', '\u200c', '\u200d', '\u200e', '\u200f')`	Zero width characters to use to encode the private text. Use the `list` argument to see some possible characters.
`-e`, `--encryption`	`string`	{`AES`, `RSA`, `PGP`}		Encryption type.
`-m`, `--mask`	`string`	`<hidden_text>`		Text to hide in another text (public text). `Required` Note: cannot be used with `-M`, `--mfile`
`-M`, `--mfile`	`string`	`<path_to_file>`		Text from a file to hide in another text (public text). `Required` Note: cannot be used with `-m`, `--mask`
`-s`, `--space`	`boolean`	`[[y/yes/true, n/no/false]]`	`True`	If enabled, it allows a better discretion by only putting spaces of zero width in existing visible spaces.
`-t`, `--threshold`	`integer`	`<number>`	`35`	Size of an encoding string, the larger the number, the more it is possible to encode different characters. However it is best to keep a small size in order to remain discreet.
`-u`, `--unconstrain`	`boolean`	`[[y/yes/true, n/no/false]]`	`False`	If enabled (enabled by default), hides the masking parameters with the private text in the cover text (public text). In order not to need to remember the parameters at the time of extraction.
`-z`, `--equalize`	`boolean`	`[[y/yes/true, n/no/false]]`	`True`	If enabled, evenly distribute the zero width spaces, corresponding to the hidden text (private text), on the set of visible spaces of the cover text (public text).

Extract module

Parameter	Type	Format	Default	Note
`-c`, `--characters`	`string`	`"<char_1>, <char_2>, ..."`	`('\u200b', '\u200c', '\u200d', '\u200e', '\u200f')`	Zero width characters to use to decode the private text. Use the 'list' argument to see some possible characters.
`-e`, `--encryption`	`string`	{`AES`, `RSA`, `PGP`}		Encryption type.
`-t`, `--threshold`	`integer`	`<number>`	`35`	Size of an encoding string, the larger the number, the more it is possible to encode different characters. However it is best to keep a small size in order to remain discreet.

Bruteforce module

Parameter	Type	Format	Default	Note
`-b`, `--base`	`integer`	`<base>`		Manually choose a fixed base (e.g : 2 for binary) to force the text. Please note, the base chosen cannot exceed the number of zero width spaces available in the lists.
`-c`, `--characters`	`string`	`"<char_1>, <char_2>, ..."`	`('\u200b', '\u200c', '\u200d', '\u200e', '\u200f')`	Zero width characters to use to decode the private text.
`-d`, `--demo`	`integer`	`<preview_size>`	`50`	Size of the preview in number of characters. This allows you to quickly view and analyze bruteforce attempts.
`-e`, `--encryption`	`string`	{`AES`, `RSA`, `PGP`}		Encryption type.
`-s`, `--search`	`string`	`"<term_1>, <term_2>, ..."`		Specific terms to search for validate a bruteforce attempt. Note: cannot be used with `-w`, `--wily`
`-t`, `--threshold`	`string`	`"<start_range>, <end_range>"`	`(10, 38)`	Size of an encoding string, the larger the number, the more it is possible to encode different characters. Select the threshold range to test.
`-w`, `--wily`	`boolean`	`[[y/yes/true, n/no/false]]`	True	Intelligent algorithm that only selects attempts that can be interesting to study. Please note that this is largely based on the composition of the latin alphabet.

Arguments in common

Parameter	Type	Format	Default	Note
`-f`, `--force`	`string`			Overwrite the output file if already existing.
`-o`, `--output`	`string`	`<output_file>`		File to store the results.
`-p`, `--public`	`string`	`<public_text>`		Visible text to use entered from the command line. `Required` Note: cannot be used with `-P`, `--pfile`
`-P`, `--pfile`	`string`	`<path_to_file>`		Visible text to use from a text file. `Required` Note: cannot be used with `-p`, `--public`
`-q`, `--quiet`	`boolean`		`False`	Disable output verbosity.
`-v`, `--verbose`	`boolean`		`False`	Increase output verbosity.

✒️ Examples

1 - Detect zero width characters in text file by displaying them as red dotted markers on standard output :

$ zwsp-tool detect -P path_to_file/suspicious_text.txt

2 - Remove zero width characters from a text file :

$ zwsp-tool clean -P path_to_file/suspicious_text.txt

3 - Hide private text in cover text with encryption and store the result in an external file :

$ zwsp-tool -o result.txt embed -p "Public text" -m "Private text" -e AES

4 - Extract a private text contained in a cover text and display it on standard output :

$ zwsp-tool extract -P path_to_file/text.txt -e AES

5 - Bruteforce a suspicious text containing zero-width characters :

$ zwsp-tool bruteforce -P path_to_file/suspicious_text.txt

📋 To-do list

add other type of encryption
improve zero width space detection
operate the unconstrained mode

TwistAtom/ZWSP-Tool