textbook/index.html

## index.html
<!DOCTYPE html>
<html lang="en">

<head>
    <meta charset="UTF-8" />
    <title>URL Extractor</title>
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/bulma/0.9.0/css/bulma.min.css">
</head>

<body>
    <section class="section">
        <div class="container">
            <h1 class="title">URL Extractor</h1>

            <p>Extract original URLs from rewriting. Supports:</p>

            <div class="content">
                <ul>
                    <li>Proofpoint v1</li>
                    <li>Proofpoint v2</li>
                    <li>Outlook Safelinks</li>
                </ul>
            </div>

            <form id="form" class="field has-addons">
                <div class="control is-expanded">
                    <input class="input" title="Rewritten URL" type="text" id="originalUrl" placeholder="Rewritten URL">
                </div>

                <div class="control is-expanded">
                    <button class="button is-info" type="submit">Extract URL</button>
                </div>
            </form>

            <p id="output"></p>
        </div>
    </section>

    <script>
        // Decode rewritten URLs based on published Python utility:
        // https://help.proofpoint.com/Threat_Insight_Dashboard/Concepts/How_do_I_decode_a_rewritten_URL%3F

        function writeMessage(content) {
            document.querySelector("#output").textContent = content;
        }

        function writeUrl(url) {
            var parser = document.createElement("a");
            parser.href = url;
            var hostname = parser.hostname;
            document.querySelector("#output").innerHTML = url.replace(hostname, "<strong>" + hostname + "</strong>");
        }

        function decodeV1Url(url) {
            return decodeURIComponent(url);
        }

        function decodeV2Url(url) {
            return decodeV1Url(url.replace(/_/g, "/").replace(/-/g, "%"));
        }

        document.addEventListener("DOMContentLoaded", function () {
            document.querySelector("#form").addEventListener("submit", function (event) {
                event.preventDefault();
                var originalUrl = document.querySelector("#originalUrl").value;

                var parser = document.createElement("a");
                parser.href = originalUrl;
                var params = new URLSearchParams(parser.search);
                var url;

                switch (true) {
                    case !!originalUrl.match(/^https:\/\/urldefense.proofpoint.com\/v2/):
                        url = decodeV2Url(params.get("u"));
                        break;
                    case !!originalUrl.match(/^https:\/\/urldefense.proofpoint.com\/v1/):
                        url = decodeV1Url(params.get("u"));
                        break;
                    case !!originalUrl.match(/^https:\/\/[a-z\d]+.safelinks.protection.outlook.com/):
                        url = decodeV1Url(params.get("url"));
                        break;
                    default:
                        writeMessage("Not a recognised URL");
                        return;
                }
                writeUrl(url);
            });
            document.querySelector("#originalUrl").focus();
        });
    </script>
</body>
</html>
	<!DOCTYPE html>
	<html lang="en">

	<head>
	<meta charset="UTF-8" />
	<title>URL Extractor</title>
	<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/bulma/0.9.0/css/bulma.min.css">
	</head>

	<body>
	<section class="section">
	<div class="container">
	<h1 class="title">URL Extractor</h1>

	<p>Extract original URLs from rewriting. Supports:</p>

	<div class="content">
	<ul>
	<li>Proofpoint v1</li>
	<li>Proofpoint v2</li>
	<li>Outlook Safelinks</li>
	</ul>
	</div>

	<form id="form" class="field has-addons">
	<div class="control is-expanded">
	<input class="input" title="Rewritten URL" type="text" id="originalUrl" placeholder="Rewritten URL">
	</div>

	<div class="control is-expanded">
	<button class="button is-info" type="submit">Extract URL</button>
	</div>
	</form>

	<p id="output"></p>
	</div>
	</section>

	<script>
	// Decode rewritten URLs based on published Python utility:
	// https://help.proofpoint.com/Threat_Insight_Dashboard/Concepts/How_do_I_decode_a_rewritten_URL%3F

	function writeMessage(content) {
	document.querySelector("#output").textContent = content;
	}

	function writeUrl(url) {
	var parser = document.createElement("a");
	parser.href = url;
	var hostname = parser.hostname;
	document.querySelector("#output").innerHTML = url.replace(hostname, "<strong>" + hostname + "</strong>");
	}

	function decodeV1Url(url) {
	return decodeURIComponent(url);
	}

	function decodeV2Url(url) {
	return decodeV1Url(url.replace(/_/g, "/").replace(/-/g, "%"));
	}

	document.addEventListener("DOMContentLoaded", function () {
	document.querySelector("#form").addEventListener("submit", function (event) {
	event.preventDefault();
	var originalUrl = document.querySelector("#originalUrl").value;

	var parser = document.createElement("a");
	parser.href = originalUrl;
	var params = new URLSearchParams(parser.search);
	var url;

	switch (true) {
	case !!originalUrl.match(/^https:\/\/urldefense.proofpoint.com\/v2/):
	url = decodeV2Url(params.get("u"));
	break;
	case !!originalUrl.match(/^https:\/\/urldefense.proofpoint.com\/v1/):
	url = decodeV1Url(params.get("u"));
	break;
	case !!originalUrl.match(/^https:\/\/[a-z\d]+.safelinks.protection.outlook.com/):
	url = decodeV1Url(params.get("url"));
	break;
	default:
	writeMessage("Not a recognised URL");
	return;
	}
	writeUrl(url);
	});
	document.querySelector("#originalUrl").focus();
	});
	</script>
	</body>
	</html>