iocextract
iocextract copied to clipboard
Extracting URLs that have been base64 encoded
Currently, it seems like iocextract extracts only the first URL found in a base64 encoded string.
For example for the following string (original):
'https://google.com https://amazon.com https://microsoft.com http://google.com http://amazon.com http://microsoft.com'
the base64 encoded string is: 'aHR0cHM6Ly9nb29nbGUuY29tIGh0dHBzOi8vYW1hem9uLmNvbSBodHRwczovL21pY3Jvc29mdC5jb20gaHR0cDovL2dvb2dsZS5jb20gaHR0cDovL2FtYXpvbi5jb20gaHR0cDovL21pY3Jvc29mdC5jb20g'
and only the first found URL is returned.
If I change the sequence of the URLs in the original string and then encode it with base 64, iocextract will return the URL that occurs first this time.
Can you please fix this and return all the URLs existing in a base64 encoded string?