Defang URL

Category: Networking

Status: Registered and callable in the CyberChef 11.3.0 compatibility inventory.

Input / output: string → string

Background: https://isc.sans.edu/forums/diary/Defang+all+the+things/22744/

What it does

Takes a Universal Resource Locator (URL) and ‘Defangs’ it; meaning the URL becomes invalid, neutralising the risk of accidentally clicking on a malicious link. This is often used when dealing with malicious links or IOCs. Works well when combined with the ‘Extract URLs’ operation.

Note

Status here means the operation name is implemented and callable. It does not by itself promise byte-for-byte parity for every upstream option. See Compatibility and current status for the verified scope and known boundaries.

Arguments and options

Arguments are positional. Keep their order when using bake() or Pipeline.then().

Index	Name	UI type	PyChef default	Accepted values / format
`0`	Escape dots	`boolean`	`True`	`True` or `False`
`1`	Escape http	`boolean`	`True`	`True` or `False`
`2`	Escape ://	`boolean`	`True`	`True` or `False`
`3`	Process	`option`	`'Valid domains and full URLs'`	`'Valid domains and full URLs'`, `'Only full URLs'`, `'Everything'`

Recipe template

Important

This is a call template built from the documented defaults. Replace placeholder values such as empty keys, paths, patterns, or lookup data before running it.

from pychef import bake

input_value = "example"
args = [True, True, True, 'Valid domains and full URLs']
result = bake(input_value, [{"op": 'Defang URL', "args": args}])
print(result)

Pipeline example

from pychef import Pipeline

args = [True, True, True, 'Valid domains and full URLs']
transform = Pipeline().then('Defang URL', *args)
result = transform("example")

Direct call

pychef.ops.run_operation runs any registered operation as a plain function, under the active ExecutionPolicy (safe defaults, no network):

from pychef.ops import run_operation

args = [True, True, True, 'Valid domains and full URLs']
result = run_operation('Defang URL', "example", args=args)

Common operations also have typed helpers in Direct operations.

Low-level operation module

Warning

The module below is an internal implementation detail. It applies no execution policy, resource limits, or error sanitization; prefer bake(), Pipeline, or pychef.ops for application code.

The registered entry point lives in pychef.operations.by_operation.defang_url. Direct calls receive the input value and a positional argument tuple:

from pychef.operations.by_operation.defang_url import run

result = run("example", tuple([True, True, True, 'Valid domains and full URLs']))

pychef.operations.by_operation.defang_url.run(value, args)

Run this operation using its shared internal implementation.

Parameters:

value (str | bytes)
args (Sequence[Any])

Return type:

str | bytes