From 5a22106731bac745fb230cc3d776e3eeda9dd28f Mon Sep 17 00:00:00 2001 From: arnydo Date: Tue, 16 Oct 2018 15:02:39 -0400 Subject: [PATCH 1/2] Create DefangURL.mjs --- src/core/operations/DefangURL.mjs | 43 +++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 src/core/operations/DefangURL.mjs diff --git a/src/core/operations/DefangURL.mjs b/src/core/operations/DefangURL.mjs new file mode 100644 index 00000000..9917b47a --- /dev/null +++ b/src/core/operations/DefangURL.mjs @@ -0,0 +1,43 @@ +/** + * @author arnydo [arnydo@protonmail.com] + * @copyright Crown Copyright 2016 + * @license Apache-2.0 + */ + +import Operation from "../Operation"; + +/** + * DefangURL operation + */ +class DefangURL extends Operation { + + /** + * DefangURL constructor + */ + constructor() { + super(); + + this.name = "Defang URL"; + this.module = "URL"; + this.description = "Takes a Universal Resource Locator (URL) and 'Defangs' it; meaning, the URL becomes invalid and neutralizes the risk of accidentally clicking on a malicious link.

This is often used when dealing with malicious links or IOCs.

Works well when combined with the 'Extract URLs' operation."; + this.infoURL = ""; + this.inputType = "string"; + this.outputType = "string"; + this.args = []; + } + + /** + * @param {string} input + * @param {Object[]} args + * @returns {string} + */ + run(input, args) { + let defang = input.replace(/http/gi, "hxxp"); + defang = defang.replace(/\./g, "[.]"); + defang = defang.replace(/:\/\//g, "[://]"); + return defang; + } + +} + +export default DefangURL; From 69033a7343ba2ef16ee862fbbfe672c87e3c63f0 Mon Sep 17 00:00:00 2001 From: arnydo Date: Tue, 16 Oct 2018 15:03:29 -0400 Subject: [PATCH 2/2] Add Defang URL --- src/core/config/Categories.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/core/config/Categories.json b/src/core/config/Categories.json index ca762f1d..36c26131 100755 --- a/src/core/config/Categories.json +++ b/src/core/config/Categories.json @@ -207,7 +207,8 @@ "Escape string", "Unescape string", "Pseudo-Random Number Generator", - "Sleep" + "Sleep", + "Defang URL" ] }, {