ioc-extractor/dist/chunk-AUD6FQ2X.js

IoC (Indicator of Compromise) extractor

// src/aux/utils.ts
import punycode from "punycode.js";
function dedup(array) {
  return Array.from(new Set(array));
}
function sortByValue(array) {
  return array.sort();
}
function orRegExp(regexps) {
  return new RegExp(regexps.map((r) => r.source).join("|"), "gi");
}
function hasDot(s) {
  return ["\\.", " . ", "[.", "(.", "{.", "[dot", "(dot", "{dot"].some(
    (x) => s.includes(x)
  );
}
function hasColon(s) {
  return ["[:", "(:", "{:"].some((x) => s.includes(x));
}
function hasSlash(s) {
  return ["[/", "(/", "{/"].some((x) => s.includes(x));
}
function hasColonDoubleSlash(s) {
  return ["[://", "(://", "{://"].some((x) => s.includes(x));
}
function hasAt(s) {
  return ["[@", "(@", "{@", "[at", "(at", "{at"].some((x) => s.includes(x));
}
function hasHttp(s) {
  return ["hxxp", "h**p"].some((x) => s.includes(x));
}
function refang(s) {
  if (hasDot(s)) {
    s = s.replace(
      orRegExp([
        /\s\.\s/,
        /([[({])\.([\])}])/,
        /([[({])\./,
        /\.([\])}])/,
        /\\\./,
        /([[({])dot([\])}])/
      ]),
      "."
    );
  }
  if (hasColon(s)) {
    s = s.replace(/[[({]:[\])}]/g, ":");
  }
  if (hasSlash(s)) {
    s = s.replace(/[[({]\/[\])}]/g, "/");
  }
  if (hasColonDoubleSlash(s)) {
    s = s.replace(/[[({]:\/\/[\])}]/g, "://");
  }
  if (hasAt(s)) {
    s = s.replace(/[[({](?:at|@)[\])}]/gi, "@");
  }
  if (hasHttp(s)) {
    s = s.replace(/h(?:xx|\*\*)p(s?):\/\//gi, "http$1://");
  }
  return s;
}
function unicodeToASCII(s) {
  return punycode.toASCII(s);
}

export {
  dedup,
  sortByValue,
  refang,
  unicodeToASCII
};