ProofPoint URL-Defense Decoder:

I created this tool because I needed a way to decode re-written/encoded URL's from ProofPoint in a GUI-based tool. This was originally designed to be compiled using pyinstaller and run as an exe on Windows OS machines, but it should work as a binary on Linux kernel environments.

The official documentation on ProofPoint's re-write process can be found at this LINK. Also an ❗IMPORTANT note, part of this code is written by a ProofPoint engineer who exposes the decoding process as a Python class that can be used. I took that functionality and incorporated it into this GUI setup, but I do not claim the rights to this code and all attribution goes to the original author.

LINK to details & author.

__author__ = 'Eric Van Cleve'
__copyright__ = 'Copyright 2019, Proofpoint Inc'
__license__ = 'GPL v.3'
__version__ = '3.0.1'
__email__ = '[email protected]'
__status__ = 'Production'

Tool Functionality:

• Will create a GUI that will accept a encoded URL and return the decoded URL
• Can accept copy/paste or manually typed encoded URL

Tool Requirements:

• To use the default functionality of this tool (watching folders, and creating hashes) a library will need to be installed using pip
  • tkinter
• This tool needs a Python interpreter, v3.6 or higher due to string interpolation

Quick Notes:

• This can be converted to a standalone exe if run on Windows OS
• This should work on Linux, OSX, or Windows OS's
• I have provided a couple of encoded URL examples that can be tested in the 'example_encoded_urls.txt' file

Resource Path:

rootdir:.
│   .gitignore
│   config.json
│   example_encoded_urls.txt
│   main.py
│   README.md
│
├───resources
│   │   tkinter_gui.py
│   │   url_decoder.py
│   │   utils.py
│   │   __init__.py
│

Using the Tool:

Step 1:

Run the binary or standalone exe to start the tkinter GUI.

Step 2:

Either copy/paste or manually define the encoded URL.

Step 3:

Review the output from the GUI.

#blueteam