From 54c0717202dab62e8a7c65c45fa7d8b041e71a95 Mon Sep 17 00:00:00 2001
From: Ross Brown <Ross_Brown@bnz.co.nz>
Date: Thu, 3 Dec 2020 10:46:08 +1300
Subject: [PATCH] Add URL Defang and URL Refang scripts

---
 Boop/Boop/scripts/URLDefang.js | 18 ++++++++++++++++++
 Boop/Boop/scripts/URLRefang.js | 18 ++++++++++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 Boop/Boop/scripts/URLDefang.js
 create mode 100644 Boop/Boop/scripts/URLRefang.js

diff --git a/Boop/Boop/scripts/URLDefang.js b/Boop/Boop/scripts/URLDefang.js
new file mode 100644
index 00000000..2bde9559
--- /dev/null
+++ b/Boop/Boop/scripts/URLDefang.js
@@ -0,0 +1,18 @@
+/**
+  {
+    "api":1,
+    "name":"Defang",
+    "description":"Defangs dangerous URLs and other IOCs",
+    "author":"Ross",
+    "icon":"link",
+    "tags":"defang,url,ioc"
+  }
+**/
+
+function main(input) {
+    url = input.text;
+    url = url.replace(/\./g, "[.]");
+    url = url.replace(/http/gi, "hXXp");
+    url = url.replace(/:\/\//g, "[://]");
+    input.text = url;
+}
\ No newline at end of file
diff --git a/Boop/Boop/scripts/URLRefang.js b/Boop/Boop/scripts/URLRefang.js
new file mode 100644
index 00000000..9a2fa37a
--- /dev/null
+++ b/Boop/Boop/scripts/URLRefang.js
@@ -0,0 +1,18 @@
+/**
+  {
+    "api":1,
+    "name":"Refang",
+    "description":"Removes defanging from dangerous URLs and other IOCs",
+    "author":"Ross",
+    "icon":"link",
+    "tags":"refang,url,ioc"
+  }
+**/
+
+function main(input) {
+    url = input.text;
+    url = url.replace(/\[\.\]/g, ".");
+    url = url.replace(/hXXp/gi, "http");
+    url = url.replace(/\[:\/\/\]/g, "://");
+    input.text = url;
+}
\ No newline at end of file