Skip to content

Defanger is a Notepad++ plugin that defangs/refangs malicious IOCs.

License

Notifications You must be signed in to change notification settings

0x4427/Defanger

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

16 Commits
 
 
 
 
 
 
 
 

Repository files navigation

Defanger

A Notepad++ plugin to neutralize and restore the functionality of Indicators of Compromise (IOCs) by defanging and refanging them.

  • Selective or whole-text defanging: You can choose between defanging/refanging selected portions of the text or applying the process to the entire content of the Notepad++ document. This makes it convenient for handling IOCs of varying lengths and complexities.
  • Supports full URLs, valid domains, IPv4 and IPv6 addresses.

Installation

  1. Create Defanger folder in Notepad++'s plugins installation folder.
  2. Copy Defanger.dll from the Defanger release zip file into the newly created folder. Please use the correct archive version based on your Notepad++ architecture - x86, x64.
  3. Restart Notepad++ and you are all set.
  4. Alternatively, download the source and build it - the build will copy the dll to the Notepad++'s plugins folder.

Usage

  • When applied to the selected text Defang defangs any valid URLs, domains and IP addresses whichever included in the selected portion.

sample3 (2)

  • Selected Defang

sample4

  • Auto Defang All defangs all the valid URLs, domains and IP addresses found in the document while excluding the invalid ones.

new1

  • Defanged all text in the document excluding one invalid IP address.

new2

  • Refang and Auto Refang All supported styles

fubal1

  • Refanged output

final

Styles
hxxp(s) -> http(s)
hXXp(s) -> http(s)
[://] -> ://
[.] -> .
{.} -> .
(.) -> .
[dot] -> .
{dot} -> .
(dot) -> .
[:] -> :
\. -> .
[/] -> /

Authors

0x4427


 

knight0x07


 

Misc

This plugin has been created using the Notepad++ pluginpack for .Net https://github.com/kbilsted/NotepadPlusPlusPluginPack.Net/releases