Application Layer Covert Channel Analysis and ... - Bill Buchanan

Z. Kwecka, BSc (Hons) Network Computing, 2006 119}}HTTPClient.cs (classes modified or added to Mentalis.org Proxy):///Gets or sets a StringDictionary that stores the header fields.///A StringDictionary that stores the header fields.private StringDictionary HeaderFieldsSignature{get{return m_HeaderFieldsSignature;}set{m_HeaderFieldsSignature = value;}}///Parses a specified HTTP query into its header fields.///The HTTP query string to parse.///A StringDictionary object containing all the header fields with theirdata.///The specified query is null.private StringDictionary ParseQuerySignature(string Query){int order = 0;StringDictionary retdict = new StringDictionary();string [] Lines = Query.Replace("\r\n", "\n").Split('\n');int Cnt, Ret;//Extract requested URL//parsing of headers followsfor(Cnt = 1; Cnt < Lines.Length; Cnt++){Ret = Lines[Cnt].IndexOf(":");if (Ret > 0 && Ret < Lines[Cnt].Length - 1){try{retdict.Add(Lines[Cnt].Substring(0, Ret), order.ToString());order++;}catch {}}}return retdict;}///Rebuilds the HTTP query, starting from the HttpRequestType,RequestedPath, HttpVersion and HeaderFields properties.///A string representing the rebuilt HTTP query string.private string RebuildQuery() {string ret = HttpRequestType + " " + RequestedPath + " " + HttpVersion + "\r\n";if (HeaderFields != null) {string [] keys = new string [HeaderFieldsSignature.Count];foreach (string sc in HeaderFields.Keys) {if (sc.Length < 6 || !sc.Substring(0, 6).Equals("proxy-") || ConsoleBuffer.sender== true && sc.Substring(0, 6).Equals("proxy-")){if(ConsoleBuffer.filter_out.ContainsKey("Spacing")){if(ConsoleBuffer.filter_out.ContainsKey("Case")){keys[Convert.ToInt16(HeaderFieldsSignature[sc])]= System.Globalization.CultureInfo.CurrentCulture.TextInfo.ToUpper(sc) + ": "+ (string)HeaderFields[sc] + " \t\t \t\t \t"+"\r\n";}