gchq / CyberChef

The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis

Home Page:https://gchq.github.io/CyberChef

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Bug report: Extract domain function ignores domains containing underscores

nwCDDO opened this issue · comments

Describe the bug
When extracting domains from text the extract ignores domain names containing underscores. Underscores are valid characters in domain names and used quite often (for example in DMARC records).

To Reproduce
Steps to reproduce the behaviour or a link to the recipe / input used to cause the bug:

  1. Add the Extract domains function to the recipe
  2. Paste data containing domain names with underscores in the Input box
  3. Click Bake!
  4. Domain names containing underscores are excluded from the Output

Expected behaviour
Domain names containing underscores should be includes in the Output, whether at the start or in the middle of the FQDN.

Example Input
urn:h:domain:sipdir.online.lync.com rrType SRV category DNS revision 13 rrDomain lewes-tc.gov.uk causeDomain sipdir.online.lync.com danglingType nxdomain causeDomainOther sipdir.online.lync.com rrEffectiveDomain _sip._tls.lewes-tc.gov.uk

Expected Output
sipdir.online.lync.com
lewes-tc.gov.uk
sipdir.online.lync.com
sipdir.online.lync.com
_sip._tls.lewes-tc.gov.uk <- this does not appear in the Output

Desktop (if relevant, please complete the following information):

  • OS: [e.g. Windows]
  • Browser: [e.g. chrome 72, firefox 60]
  • CyberChef version: Version: 10.19.2

Additional context

  • Compile time: 14/08/2024 15:58:19 UTC
  • User-Agent:
    Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
  • Link to reproduce