Skip to content

Instantly share code, notes, and snippets.

@fm

fm/PFPT URL Defense Decoder.html

Last active December 6, 2019 00:05
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save fm/f76e74cd742b2d033e61075ee1540e99 to your computer and use it in GitHub Desktop.
Save fm/f76e74cd742b2d033e61075ee1540e99 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
PFPT URL Defense Decoder.html
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>TAP URL Decoder</title>
</head>
<style type="text/css">
pre {
display: block;
padding: 9.5px;
margin: 0 0 10px;
font-size: 13px;
line-height: 1.42857;
word-break: break-all;
word-wrap: break-word;
color: #333;
background-color: #f5f5f5;
border: 1px solid #ccc;
border-radius: 4px
}
</style>
<body>
<h3>Rewritten URL decoder</h3>
<p>To make the link more readable, users can use the below decoder to restore the original link text.</p>
<p>Copy and paste the rewritten link into the box and click Decode which will provide you with the original link.</p>
<p><strong>WARNING:</strong> Skipping the TAP check may lead you to malicious sites. Use decoder with caution. </p>
<pre>
<div class = "main">
<form>
<input type="text" name="URL" size="100" placeholder="Proofpoint URL">
<input type="submit" value="Decode" onclick="DoParse(URL); return false;">
</form>
</div>
<div class = "answer">Decoded URL:</div>
<script>
function DoParse(URL){
//var URL2 = URL.value.replace(/_/g, "/").replace(/-2D/g, "-").replace(/-3A/g, ":").replace(/>/g, "")
var beginning = URL.value.indexOf("l?u=") + 4
var end = URL.value.indexOf("&d=")
var URL2 = URL.value.substring(beginning, end)
var final = URL2.replace(/-3A/g, ":").replace(/_/g, "/").replace(/-7E/g, "~").replace(/-2560/g, "`").replace(/-21/g, "!").replace(/-40/g, "@").replace(/-23/g, "#")
var final2 = final.replace(/-24/g, "$").replace(/-25/g, "%").replace(/-255E/g, "^").replace(/-26/g, "&").replace(/-2A/g, "*").replace(/-28/g, "(").replace(/-29/g, ")")
var final3 = final2.replace(/-5F/g, "_").replace(/-2B/g, "+").replace(/-2D/g, "-").replace(/-3D/g, "=").replace(/-257B/g, "{").replace(/257D/g, "}").replace(/-257C/g, "|")
var final4 = final3.replace(/-5B/g, "[").replace(/-5D/g, "]").replace(/-255C/g, "\\").replace(/-26quot-3B/g, "\"").replace(/-3B/g, ";").replace(/-26-2339-3B/g, "'").replace(/-26lt-3B/g, "<")
var final5 = final4.replace(/-26gt-3B/g, ">").replace(/-3F/g, "?").replace(/-2C/g, ",")
//var final = URL2.substring(beginning, end)
document.querySelector(".answer").innerHTML = "Decoded URL: " + final4
}
</script>
</body>
</html>
</pre>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment