Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: Internet Storm Center - SANS Internet Storm Center Internet Storm Center


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Latest Diaries

Defang all the things!

Published: 2017-08-22
Last Updated: 2017-08-22 06:29:45 UTC
by Xavier Mertens (Version: 1)
0 comment(s)

Today, I would like to promote a best practice via a small Python module that is very helpful when you’re dealing with suspicious or malicious URLs. Links in documents are potentially dangerous because users can always click by mistake on them. Many automated tools and scripts are processing documents to fetch links. Even if the original document does not provide dynamic links, many applications will detect them and change them to real links. Clicking on a link could not only affect the security of the user/computer but it could also leak data or pollute statistics. A good example is the kill switch domain of WannaCry that was linked in many articles by journalists a few weeks ago.

The classic technique to prevent URLs to be “clickable” is to defang them.  Defang means, the HTML part of the URL is “changed” but still readable for the human eye. It will look like this:

"https://isc.sans.edu/" is replaced with "hXXps://isc.sans[.]edu/"

Python is a powerful language available on all operating systems and has plenty of modules. Of course, there is a “defang module” available[1]. To install it, just use pip:

# pip install defang

The module is available in your Python scripts but also as a standalone tool:

# echo https://isc.sans.edu/ | defang
hXXps://isc.sans[.]edu/

You can process an existing file, all found URLs will be defanged:

# defang -i /tmp/urls.tmp | tee /tmp/urls.txt.safe
hXXps://blog.rootshell[.]be
fXp://ftp.belnet[.]be
hXXp://www.acme[.]com

In Python:

# python
Python 2.7.12 (default, Nov 19 2016, 06:48:10)
[GCC 5.4.0 20160609] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> from defang import defang
>>> u="https://isc.sans.edu/"
>>> defang(u)
'hXXps://isc.sans[.]edu/'
>>>

On my MacBook, I automated this with a Service to defang the select text and replace it:

The classic scenario is to defang URLs in emails. In the Mail application, I just select the email body to defang all the URLs in one shot!

Finally, defang can also "refang" URLs:

# echo 'hXXps://blog.rootshell[.]be' | defang -r
https://blog.rootshell.be

That's easy and safer when you need to exchange malicious links with your peers!

[1] https://pypi.python.org/pypi/defang

Xavier Mertens (@xme)
ISC Handler - Freelance Security Consultant
PGP Key

Keywords: defang python url
0 comment(s)

If you have more information or corrections regarding our diary, please share.

Recent Diaries

It's Not An Invoice ...
Aug 20th 2017
1 day ago by DidierStevens (0 comments)

tshark 2.4 New Feature - Command Line Export Objects
Aug 19th 2017
2 days ago by Guy (0 comments)

EngineBox Malware Supports 10+ Brazilian Banks
Aug 18th 2017
3 days ago by Renato (0 comments)

Maldoc with auto-updated link
Aug 17th 2017
5 days ago by Xme (1 comment)

Analysis of a Paypal phishing kit
Aug 16th 2017
6 days ago by Xme (0 comments)

(Banker(GoogleChromeExtension)).targeting("Brazil")
Aug 15th 2017
6 days ago by Renato (0 comments)

Malspam pushing Trickbot banking Trojan
Aug 15th 2017
6 days ago by Brad (0 comments)

View All Diaries →

Latest Discussions

DShield Sensor
created Aug 21st 2017
19 hours ago by Thomas (0 replies)

Mobile App TLS connection
created Aug 13th 2017
1 week ago by Anonymous (0 replies)

RSS Feed: Example of Infocon level change?
created Aug 8th 2017
1 week ago by Matt M. (2 replies)

Topics
created Aug 4th 2017
2 weeks ago by Anonymous (0 replies)

Benefits of IoT Security
created Aug 1st 2017
3 weeks ago by Madison (0 replies)

View All Forums →

Latest News

View All News →

Top Diaries

Wide-scale Petya variant ransomware attack noted
Jun 27th 2017
1 month ago by Brad (6 comments)

Using a Raspberry Pi honeypot to contribute data to DShield/ISC
Aug 3rd 2017
2 weeks ago by Johannes (10 comments)

Maldoc with auto-updated link
Aug 17th 2017
5 days ago by Xme (1 comment)

OAUTH phishing against Google Docs ? beware!
May 3rd 2017
3 months ago by Bojan (6 comments)

Microsoft Patch Tuesday August 2017
Aug 8th 2017
1 week ago by Johannes (6 comments)