search

cardi / proofpoint-url-decoder

tools to mess around with proofpoint URLs
Creative Commons Zero v1.0 Universal
19 stars 4 forks source link

urldefense v3: new encoding #4

Closed cardi closed 2 years ago

cardi commented 4 years ago

Example URL: https://urldefense[.]com/v3/__https://contact.framasoft.org/*newsletter__;Iw!!LIr3w8kk_Xxm!6BNqFLJ13q7N5_lf3XQFlmTtgY5CkKjhfcIn4ybAhA1_gx_y07jmQ4uvR2QZ$

rstory commented 4 years ago

looks to me like you just need to extract what's between the double underscore pairs.. this works for me as a shell script:

echo "$url" | sed -e 's/.*__\(.*\)__;.*/\1/'

cardi commented 4 years ago

Thanks, @rstory.

I think there is some additional decoding in the extracted URL, for example I think * decodes to _? There are probably some other mappings (!?) I'm not thinking of.

And it looks like some of the other parameters have been moved. Looks like !! and ! might be delimeters and then they've done some other encoding or aggregation on the rest.