unfurl

unfurl copied to clipboard

obsidianforensics

parsing suggestion: recognize and decode 12-byte Mongo object ID timestamp (first four bytes)

2

I just read https://techkranti.com/idor-through-mongodb-object-ids-prediction/, and it brought to mind a case I was working last week. Not positive it was actually this, but I'm going to check when I get...

johnmccash

**Description** The Text Fragments feature in browsers adds support for specifying a text snippet in the URL hash. Unfurl should be able to parse this out and explain what it...

obsidianforensics

**Description** GitHub URLs have a lot of info in them describing what is being viewed. **Examples** - https://github.com/obsidianforensics/unfurl/blob/master/unfurl/parsers/parse_twitter.py#L15 - From above, we can tell: - GitHub username (obsidianforensics) - Repo...

obsidianforensics

Parsing misclassification if the password begins with ? or / or #

3

These URLs cause a misclassification: - `http://test:[email protected]` - ` test:` -> URL network location - `[email protected]` -> URL query - `http://test:/[email protected]` - `test:` -> URL network location - `/[email protected]` ->...

2xyo

**Description** Unfurl has hash lookup integration with VirusTotal, but this requires an API key and is rate limited for free accounts. Add the hashlookup CIRCL API to Unfurl to do...

obsidianforensics

[Feature] Trigger expansion from a 3rd party tool

7

I'm one of the core dev of [lookyloo](https://github.com/Lookyloo/lookyloo) and I'd love not to reinvent the wheel when it gets to expanding URLs, and unfurl pretty much does exactly that. So...

Rafiot

**Description** Sometimes, we don't completely understand how to parse a long string, but we can see a timestamp in part of the string. Parse out this substring as a timestamp...

obsidianforensics

Add domain reputation checks

1

**Description** Add a lookup "parser" that takes a domain name in and shows some basic reputation things; for example popularity (Alexa 1M?) or if it has been flagged as bad...

obsidianforensics

**Description** Unfurl already decodes punycoded URLS (xn--...), but not hxxp://аbc.com (a is Slavic). It does in fact handle these (shows as % encoded, then translates back to original homograph domain....

obsidianforensics