iocextract icon indicating copy to clipboard operation
iocextract copied to clipboard

Extracting URLs that have been base64 encoded

Open k-karakatsanis opened this issue 3 years ago • 0 comments

Currently, it seems like iocextract extracts only the first URL found in a base64 encoded string.

For example for the following string (original): 'https://google.com https://amazon.com https://microsoft.com http://google.com http://amazon.com http://microsoft.com' the base64 encoded string is: 'aHR0cHM6Ly9nb29nbGUuY29tIGh0dHBzOi8vYW1hem9uLmNvbSBodHRwczovL21pY3Jvc29mdC5jb20gaHR0cDovL2dvb2dsZS5jb20gaHR0cDovL2FtYXpvbi5jb20gaHR0cDovL21pY3Jvc29mdC5jb20g' and only the first found URL is returned.

If I change the sequence of the URLs in the original string and then encode it with base 64, iocextract will return the URL that occurs first this time.

Can you please fix this and return all the URLs existing in a base64 encoded string?

k-karakatsanis avatar Mar 11 '21 08:03 k-karakatsanis