defang

README

defang

Defangs and refangs malicious IOCs

Install

Option 1: Binary

Download the latest release from https://github.com/jakewarren/defang/releases/latest

Option 2: From source

go get github.com/jakewarren/defang/...

Usage

As a binary:

defang accepts input from STDIN, a string argument, or a file argument

❯ echo -e "malware.evil.com\napp.malicious.com" | defang
malware.evil[.]com
app.malicious[.]com

❯ defang "malware.evil.com"
malware.evil[.]com

❯ defang /tmp/urls.txt
app.malicious[.]com

❯ defang --refang "hXXp://evil.example[.]com/malicious.php"
http://evil.example.com/malicious.php

As a library:

import (
	"fmt"

	"github.com/jakewarren/defang"
)

func main() {
	u, _ := defang.URL("https://malware.evil.com")
	fmt.Println(u)
	// Output: hxxps://malware.evil[.]com

	u, _ = defang.URLWithMask("https://malware.evil.com", defang.Meow)
	fmt.Println(u)
	// Output: meows://malware.evil[.]com

	defangedIP, _ := defang.IPv4("8.8.8.8")
	fmt.Println(defangedIP)
	// Output: 8.8.8[.]8
}

Changes

All notable changes to this project will be documented in the changelog.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

License

MIT © 2018 Jake Warren

Documentation

Index

• func IPv4(ip interface{}) (string, error)
• func Refang(input interface{}) (string, error)
• func URL(rawURL interface{}) (string, error)
• func URLWithMask(rawURL interface{}, m Mask) (string, error)
• type Mask

Examples

• IPv4
• URL
• URLWithMask

Functions

func IPv4

func IPv4(ip interface{}) (string, error)

IPv4 defangs an IPv4 address

Example

defangedIP, _ := IPv4("8.8.8.8")
fmt.Println(defangedIP)

Output:

8.8.8[.]8

func Refang

func Refang(input interface{}) (string, error)

Refang takes a defanged IOC and returns it to it's original form

func URL

func URL(rawURL interface{}) (string, error)

URL defangs an IPv4 address

Example

d, _ := URL("https://subdomain.bing.co.uk/search?q=testquery#testanchor")
fmt.Println(d)

Output:

hxxps://subdomain.bing[.]co[.]uk/search?q=testquery#testanchor

func URLWithMask

func URLWithMask(rawURL interface{}, m Mask) (string, error)

URLWithMask defangs a URL and applies the specified defanging scheme

Example

d, _ := URLWithMask("https://subdomain.bing.co.uk/search?q=testquery#testanchor", Meow)
fmt.Println(d)

Output:

meows://subdomain.bing[.]co[.]uk/search?q=testquery#testanchor

Types

type Mask

type Mask int

Mask allows the user to apply a different defanging scheme if they are in a fun mood

const (
	// Hxxp applies the default URL scheme of hxxp
	Hxxp Mask = iota
	// Nsfw marks the URL scheme as meow
	Nsfw
	// Meow marks the URL scheme as meow
	Meow
	// Evil marks the URL scheme as evile
	Evil
)