def test_email_refang(self):
content_list = [
'myuser@example[.]com[.]tld',
'myuser @example[.]com[.]tld',
'myuser @ example.com.tld',
'myuser@example(.)com[.tld',
'myuser@example[.]com.tld',
'myuser@example [.] com.tld',
'myuser@example [.] com [.] tld',
'myuser@example [.] com [.tld',
'myuser@example [[[ . ])] com [.tld',
'myuser[@]example [[[ . ])] com [.tld',
'myuser [ @ ] example [[[ . ])] com [.tld',
'myuser { @ ) example [[[ . ])] com [.tld',
'myuser { @ ) example { . ])] com [.tld',
'myuser { at ) example { . ])] com [.tld',
'myuser { at ) example { doT ])] com [dot tld',
'myuser At example DOT com DOT tld',
'myuser[@]example[.com[.tld]',
]
for content in content_list:
self.assertEqual(
list(iocextract.extract_emails(content, refang=True))[0],
'*****@*****.**')
self.assertEqual(iocextract.refang_email(content),
'*****@*****.**')
def ioc_parse(line):
""" Use library that can handle defanged formats for IOCs (Indicators of Compromise) """
params = []
formatted = line
for url in iocextract.extract_urls(formatted, strip=True):
refanged = iocextract.refang_url(url)
param = get_ioc_param('url', url, formatted)
param.append(refanged)
params.append(param)
formatted = '{}{}{}'.format(formatted[:param[0]], url,
formatted[param[1]:])
for ip in iocextract.extract_ipv4s(formatted):
refanged = iocextract.refang_ipv4(ip)
param = get_ioc_param('ip_address', ip, formatted)
param.append(refanged)
params.append(param)
formatted = '{}{}{}'.format(formatted[:param[0]], ip,
formatted[param[1]:])
for ip in iocextract.extract_ipv6s(formatted):
param = get_ioc_param('ip_address', ip, formatted)
params.append(param)
formatted = '{}{}{}'.format(formatted[:param[0]], ip,
formatted[param[1]:])
for email in iocextract.extract_emails(formatted):
refanged = iocextract.refang_email(email)
param = get_ioc_param('email', email, formatted)
param.append(refanged)
params.append(param)
formatted = '{}{}{}'.format(formatted[:param[0]], email,
formatted[param[1]:])
for h in iocextract.extract_hashes(formatted):
param = get_ioc_param('hash', h, formatted)
params.append(param)
formatted = '{}{}{}'.format(formatted[:param[0]], h,
formatted[param[1]:])
for rule in iocextract.extract_yara_rules(formatted):
param = get_ioc_param('yara_rule', rule, formatted)
params.append(param)
formatted = '{}{}{}'.format(formatted[:param[0]], rule,
formatted[param[1]:])
return formatted, params