defango

URL / IP / Email defanging with Golang. Make IoC harmless.

Coded with 💙 by edoardottt

Share on Twitter!

Install • Get Started • Changelog • Contributing • License

Install 📡

go get github.com/edoardottt/defango

CLI:

go install github.com/edoardottt/defango/cmd/defango@latest

Get Started 🎉

package main

import (
    "fmt"
    "log"
    "github.com/edoardottt/defango"
)

func main() {
    fmt.Println(defango.IP("8.8.8.8:53")) // 8[.]8[.]8[.]8[:]53

    u, err := defango.URL("http://malicious.example.link.com:666/m4lw4r3.exe")
    if err != nil {
      log.Fatal(err)
    }
    fmt.Println(u) // hxxp://malicious[.]example[.]link[.]com[:]666/m4lw4r3[.]exe

    fmt.Println(defango.Email("mailto:edoardott@gmail.com")) // mailto[:]edoardott@gmail[.]com

    // Defang only the IoCs in a text.
    fmt.Println(defango.Text("C2 at evil.com, payload: https://1.2.3.4/x.exe"))
    // C2 at evil[.]com, payload: hxxps://1[.]2[.]3[.]4/x[.]exe

    fmt.Println(defango.Refang("hxxps://evil[.]com"))     // https://evil.com
    fmt.Println(defango.IsDefanged("hxxps://evil[.]com")) // true
}

http, https, ftp and file become hxxp, hxxps, fxp and fxle; any other scheme gets [://]. Pass defango.HostOnly() to URL or Text to leave paths and queries as they are.

The CLI defangs its standard input, or refangs it with -r:

$ echo "C2 at evil.com, payload: https://1.2.3.4/x.exe" | defango
C2 at evil[.]com, payload: hxxps://1[.]2[.]3[.]4/x[.]exe
$ echo "hxxps://evil[.]com" | defango -r
https://evil.com

Read the full package documentation here.

Changelog 📌

Detailed changes for each release are documented in the release notes.

Contributing 🛠

Just open an issue / pull request.

Before opening a pull request, download golangci-lint and run

golangci-lint run

If there aren't errors, go ahead :)

License 📝

This repository is under MIT License.
edoardottt.com to contact me.