unfurl

unfurl copied to clipboard

**Description** IP addresses can be represented in different ways. Add support in Unfurl to parse all these variants of IP addresses: From https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/evasive-urls-in-spam/: - Dotted decimal IP address: https://216.58.199.78 (this...

obsidianforensics

**Description** The Bing parser right now is very minimal; what else can we pull from a Bing search URL? **Examples** - https://www.bing.com/search?q=unfurl&form=QBLH&sp=-1&pq=unfurl&sc=6-6&qs=n&sk=&cvid=06D0FFFC525F46F78F74C4F88F0080F7 - https://www.bing.com/images/search?q=unfurl&form=HDRSC3&first=1&scenario=ImageHoverTitle - https://www.bing.com/search?q=unfurl&filters=ex1%3a%22ez3%22&qpvt=unfurl **References** - [Existing Bing...

obsidianforensics

Investigate Google gs_lcp parameter

3

**Description** A new Google search parameter (**gs_lcp**) has appeared, and it looks like it may be the replacement for **gs_l**, which gave a lot of interesting information on search timing....

obsidianforensics

Support for additional google search urls

3

See here for other Google search urls to include https://github.com/randomaccess3/googleURLParser

randomaccess3

**Description** Add support for identifying URLs which are the results from a Google image search **Examples** - https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRVbgxmUWl8sn73Cf2oYl6XcB8kVNwrnla0DcJHqCVRsM1MioBs - https://encrypted-tbn0.gstatic.com/images?q=tbn%3AANd9GcRdmjGPmp-WUdZqONEmSdTXX-InNSBAbPkyrA&usqp=CAU

moshekaplan

**Description** Parse out a clicked URL from a Yahoo search: For example, a URL like the following: ``` https://r.search.yahoo.com/_ylt=AwrBT8OVIB9aqsoASDZXNyoA;_ylu=X3oDMTByOHZyb21tBGNvbG8DYmYxBHBvcwMxBHZ0aWQDBHNlYwNzcg--/RV=2/RE=1512018198/RO=10/RU=https%3a%2f%2fdeveloper.yahoo.com%2fcocktails%2fmojito%2fdocs%2fcode_exs%2fquery_params.html/RK=2/RS=vQW48_o6zXyIDewim5cXq8Np1zo- RU = [e for e in path.split("/") if e.startswith("RU=")] # RU=[https%3a%2f%2fdeveloper.yahoo.com%2fcocktails%2fmojito%2fdocs%2fcode_exs%2fquery_params.html]...

moshekaplan

**Description** Yahoo uses the following subdomains for different types of search: - Web Search = "search.yahoo.com" - Image Search = "images.search.yahoo.com" - Video Search = "video.search.yahoo.com" - News Search =...

moshekaplan

**Description** Add support for parsing URLs for the result from a Bing image search **Examples** * https://tse1.mm.bing.net/th/id/OET.7b7cf265df8b4028ab9fe59d1f2a81b1?w=272&h=272&c=7&rs=1&o=5&pid=1.9 **References** - N/A

moshekaplan

Add more encoding types

1

**Description** Unfurl currently supports basic url-safe b64 decoding, and only if the results are ASCII. This should be expanded to include more encoding types and chains. Currently supported: - url-safe...

obsidianforensics

ref: http://jon.glass/blog/BotTricker/

obsidianforensics