diff --git a/src/core/config/Categories.json b/src/core/config/Categories.json
index 6f02abb8..85d397c5 100755
--- a/src/core/config/Categories.json
+++ b/src/core/config/Categories.json
@@ -208,7 +208,8 @@
"Escape string",
"Unescape string",
"Pseudo-Random Number Generator",
- "Sleep"
+ "Sleep",
+ "Defang URL"
]
},
{
diff --git a/src/core/operations/DefangURL.mjs b/src/core/operations/DefangURL.mjs
new file mode 100644
index 00000000..9917b47a
--- /dev/null
+++ b/src/core/operations/DefangURL.mjs
@@ -0,0 +1,43 @@
+/**
+ * @author arnydo [arnydo@protonmail.com]
+ * @copyright Crown Copyright 2016
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation";
+
+/**
+ * DefangURL operation
+ */
+class DefangURL extends Operation {
+
+ /**
+ * DefangURL constructor
+ */
+ constructor() {
+ super();
+
+ this.name = "Defang URL";
+ this.module = "URL";
+ this.description = "Takes a Universal Resource Locator (URL) and 'Defangs' it; meaning, the URL becomes invalid and neutralizes the risk of accidentally clicking on a malicious link.
This is often used when dealing with malicious links or IOCs.
Works well when combined with the 'Extract URLs' operation.";
+ this.infoURL = "";
+ this.inputType = "string";
+ this.outputType = "string";
+ this.args = [];
+ }
+
+ /**
+ * @param {string} input
+ * @param {Object[]} args
+ * @returns {string}
+ */
+ run(input, args) {
+ let defang = input.replace(/http/gi, "hxxp");
+ defang = defang.replace(/\./g, "[.]");
+ defang = defang.replace(/:\/\//g, "[://]");
+ return defang;
+ }
+
+}
+
+export default DefangURL;