Skip to content

Instantly share code, notes, and snippets.

@jpmckinney
Last active September 25, 2015 22:09
Show Gist options
  • Save jpmckinney/cd2fa9d91973746b8f3b to your computer and use it in GitHub Desktop.
Save jpmckinney/cd2fa9d91973746b8f3b to your computer and use it in GitHub Desktop.
Notes on email unobfuscation

CloudFlare

# http://www.conservative.ca/team/member/?fname=Arnold&lname=Viersen&type=candidates
span = page.xpath('//span[@class="__cf_email__"]/@data-cfemail')
code = span[0]
operand = int(code[:2], 16)
return ''.join(chr(int(code[i:i + 2], 16) ^ operand) for i in range(2, len(code), 2))

ExpressionEngine

The two examples pages below seem to run different versions of ExpressionEngine.

# http://nslegislature.ca/index.php/people/members/patricia_arab
script = page.xpath('//dd/script/text()')
if script:
    codes = reversed(re.findall(r"]='(.+?)'", script[0]))
    content = ''.join(char(code) for code in codes)
    return re.search(r'>(.+)<', content).group(1)

# https://www.chp.ca/candidates/bow-river
script = page.xpath('//span[@class="email"]/script/text()')
if script:
    codes = reversed(re.findall(r"[\[,]'(.+?)'", script[0]))
    content = ''.join(char(code) for code in codes)
    return re.search(r'>E: (.+)<', content).group(1)

Joomla

# http://www.beaconsfield.ca/en/your-council.html
var = re.findall(r'var addy\d{4,5} = \'(.*)\'', script)[0].replace('\' + \'', '').replace('\'', '')
ext = re.findall(r'addy\d{4,5} = addy\d{4,5} \+ \'(.*);', script)[0].replace('\' + \'', '').replace('\'', '')
h = html_parser.HTMLParser()
return h.unescape(var + ext)
@jpmckinney
Copy link
Author

@tmtmtmtm: Thought you might like this (I also had to solve the CloudFlare obfuscation).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment