cristiancmoises
/
gophish
mirror of https://github.com/gophish/gophish
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Modified regex to detect Microsoft ATP URLs (#1976)

pull/2060/head
Glenn Wilkinson 2020-09-24 03:40:21 +02:00 committed by GitHub
parent 22c7b9be14
commit 0b2ab68f8d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
imap/monitor.go
View File

@ -21,8 +21,10 @@ import (
"github.com/gophish/gophish/models" "github.com/gophish/gophish/models"
) )
// Pattern for GoPhish emails e.g ?rid=AbC123 // Pattern for GoPhish emails e.g ?rid=AbC1234
var goPhishRegex = regexp.MustCompile("(\\?rid=(3D)?([A-Za-z0-9]{7}))") // We include the optional quoted-printable 3D at the front, just in case decoding fails // We include the optional quoted-printable 3D at the front, just in case decoding fails. e.g ?rid=3DAbC1234
// We also include alternative URL encoded representations of '=' and '?' to handle Microsoft ATP URLs e.g %3Frid%3DAbC1234
var goPhishRegex = regexp.MustCompile("((\\?|%3F)rid(=|%3D)(3D)?([A-Za-z0-9]{7}))")
// Monitor is a worker that monitors IMAP servers for reported campaign emails // Monitor is a worker that monitors IMAP servers for reported campaign emails
type Monitor struct { type Monitor struct {