Using HTTP and Web Server Logs to Transfer Files

Thanks to a couple posts on slashdot i decided to write up the following two scripts: stegweb and destegweb

stegweb converts a file into url-encoded hex values and then places HTTP GET requests to a server for that file.
Sample usage:
stegweb /path/to/file http://www.example.com/stegweb/filename.txt/ 65
/path/to/file is the file you want to encode
http://www.example.com/stegweb/filename.txt/ is the url to send the file to
65 is optional - can be any number - this is the number of bytes that gets transferred with each hit.

If you use apache combined style logfiles, the above example will attempt to connect to the webserver running on www.example.com and will generate logs of the form:

sender.example.com - - [27/Jul/2001:11:40:25 -0400] "GET /stegweb/filename.txt/%
6E%67%74%68%28%24%72%65%73%75%6C%74%29%20%3D%3D%20%31%20%3F%20%27%30%27%2E%24%72
%65%73%75%6C%74%20%3A%20%24%72%65%73%75%6C%74%3B%0A%09%72%65%74%75%72%6E%20%24%7
2%65%73%75%6C%74%3B%0A%7D%0A HTTP/1.0" 404 1766 "-" "lwp-trivial/1.34"

Together they can be used to transfer a file by using HTTP GET requests and then parsing through your weblogs.

I just wrote these scripts, they're kinda messy, i probably won't be modifying them as this was just a random thought experiment.

Also note that if you use these to transfer a file you will be generating a lot of lines in your web log files. At the default settings, a 3 meg mp3 will create 48396 lines ((3*1024*1024)/65) and will increase the logfile by approximately 12.6 megs ( ((((3*1024*1024)/65)*80)+ (3*1024*1024)*3) / (1024*1024) ), depending on the logfile format, hostname, etc.

Oh, and there's no error checking or anything similar in the file transfer so who knows if you're getting the right file - there should be a checksum and filename encoded into it and sequenced hits and all that, and you should be transferring encrypted files and a bunch more that just doesn't suit my mind right now because i need to leave to go see Planet of the Apes.