InQuest / iocextract

Defanged Indicator of Compromise (IOC) Extractor.

Home Page:https://inquest.readthedocs.io/projects/iocextract/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

URLs pulling in IPs

punkrokk opened this issue · comments

If I have a URL with a port - e.g. 1.1.1.1:449 I'm seeing a URL getting extracted in the format of:
http://1.1.1.1:449.

Is that desired behavior?

bump

I have the same problem, even if no port is given, if the IP is defanged.
grafik

Hi, @punkrokk!

This issue is now resolved and available in the develop branch. I will send another comment here once a new version is available for download from PyPI.

Here's an example with the new code:

import iocextract

def extract_no_scheme_urls():
    url = "1[.]1[.]1[.]1:443"
    print(list(iocextract.extract_urls(url, refang=True, no_scheme=True)))

extract_no_scheme_urls()

New version is now available on PyPI: https://pypi.org/project/iocextract/1.14.0/

New version is now available on PyPI: https://pypi.org/project/iocextract/1.14.0/

@azazelm3dj3d while it seems like the bug originally referenced in this issue is fixed in the new version, the one I commented above still exists. Defanged IPs still get extracted by extract_urls while their non-defanged counterparts don't