API tools faq
paste
ps66uk

CC-extract-URL-various

ps66uk
Nov 26th, 2018
2,782
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 3.01 KB | None | 0 0
raw download clone embed print report
  1. ------
  2. the following recipes are experimental - changes in the doc may cause them not to work
  3.  
  4. ------
  5. expanded version to extract URL from base64 encoded version of OpenXML DOC
  6.  
  7. https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true)Find_/_Replace(%7B'option':'Simple%20string','string':'%26amp;'%7D,'%26',true,false,true,false)Regular_expression('User%20defined','%3Cw:t%3E(cmd.*%22.*%26%26.*%22)%3C/w:t%3E',true,true,false,false,false,false,'List%20capture%20groups')Drop_bytes(0,-12,false)Find_/_Replace(%7B'option':'Simple%20string','string':'%5E'%7D,'',true,false,true,false)Reverse('Character')Register('%5C%5C)%5B%20,;%5D*(%5C%5Cd)',true,false,false)Regular_expression('User%20defined','(.%7B1%7D).%7B$R0%7D',true,true,false,false,false,false,'List%20capture%20groups')Remove_whitespace(true,true,true,true,true,false)Split('@','%5C%5Cn')Split('%5C'','%5C%5Cn')Extract_URLs(false)
  8.  
  9.  
  10. ---------
  11. generic version to extract URL from base64 encoded version of both XML and MSDOC format
  12.  
  13. https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true)Find_/_Replace(%7B'option':'Regex','string':'%26amp;'%7D,'',true,false,true,false)Regular_expression('User%20defined','(cmd%5B%5C%5Cw%5C%5CW%5D*%5C%5C)%5B%20%5D*%22)%3C?',true,true,true,false,false,false,'List%20matches')Drop_bytes(0,-6,false)Find_/_Replace(%7B'option':'Simple%20string','string':'%5E'%7D,'',true,false,true,false)Reverse('Character')Register('%5C%5C)%5B%20,;%5D*(%5C%5Cd)',true,false,false)Regular_expression('User%20defined','(.%7B1%7D).%7B$R0%7D',true,true,false,false,false,false,'List%20capture%20groups')Remove_whitespace(true,true,true,true,true,false)Split('@','%5C%5Cn')Split('%5C'','%5C%5Cn')Extract_URLs(false)
  14.  
  15. ------
  16. generic version to extract XML/DOC then URL from raw SMTP MSG data
  17.  
  18. https://gchq.github.io/CyberChef/#recipe=Regular_expression('User%20defined','0M8R4K%5B%5C%5Cw%5C%5CW%5D*ICag%5B%3D%5D*',true,true,false,false,false,false,'List%20matches')From_Base64('A-Za-z0-9%2B/%3D',true)Find_/_Replace(%7B'option':'Regex','string':'%26amp;'%7D,'',true,false,true,false)Find_/_Replace(%7B'option':'Simple%20string','string':'%5E'%7D,'',true,false,true,false)Regular_expression('User%20defined','(cmd%5B%5C%5Cw%5C%5CW%5D*%5B%5E%5C%5C(%5D%5C%5C)%5B%20%5D*%22)%3C?',true,true,false,false,false,false,'List%20matches')Drop_bytes(0,-15,false)Reverse('Character')Register('%5C%5C)%5B%20,%5D*(%5C%5Cd)',true,false,false)Regular_expression('User%20defined','(.%7B1%7D).%7B$R0%7D',true,true,false,false,false,false,'List%20capture%20groups')Remove_whitespace(true,true,true,true,true,false)Split('@','%5C%5Cn')Split('%5C'','%5C%5Cn')Extract_URLs(false)
  19.  
  20. ------
  21. extract PDF then URL from raw SMTP MSG data
  22.  
  23. https://gchq.github.io/CyberChef/#recipe=Regular_expression('User%20defined','pdf%22%5C%5Cn%5C%5Cn(%5B%5C%5Cw%5C%5CW%5D*)%5C%5Cn%5C%5Cn',true,true,false,false,false,false,'List%20capture%20groups')From_Base64('A-Za-z0-9%2B/%3D',true)Find_/_Replace(%7B'option':'Simple%20string','string':')'%7D,'%20',true,false,true,false)Extract_URLs(false)
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!