FM 7-03 Chapter 7 · Text
Extract from text
Pull IPs, CIDRs, URLs, domains, emails, hashes, CVEs and other indicators out of text.
Local only Runs in your browser. Nothing you enter leaves this page.
Usable as a step in ChainMode
Output
Defanging makes indicators unclickable for sharing in reports and chat: hxxps[:]//evil[.]example/x, user[@]evil[.]example, 192.0.2[.]1 style. Extraction refangs first, so defanged indicators are found too.
Hashes are classified by length only: 32 hex digits could also be an NTLM hash or a UUID without dashes. Domains skip names that end in a common file extension (report.pdf, x.zip), even where that is a real TLD. Unquoted Windows paths end at the first space; quote them to keep spaces. IPv4 addresses with leading zeros are skipped, as their meaning is ambiguous.