Hello World! #dfir #osint #python

👋 Hi there! This account will be tweeting about all things Unfurl: 🌐 Example “unfurled” URLs 🛠 Tool updates 🗂 Use cases 🧪 Research ideas Try Unfurl out at unfurl.link and let us know what you think!

Lots of interesting stuff can be hidden in URLs... #DFIR #OSINT

Need to investigate a Phishing link full of redirects & obfuscation? The unfurl tool by Ryan Benson is great for expanding & graphing links to provide a true visualisation of the URI dfir.blog/unfurl/ #dfir #infosec

Hi #OSINTSummit folks! 👋 Unfurl is a free, open source tool that you can use to "expand" complicated URLs and find interesting things inside them, like: 🕓 timestamps 🗜️ compressed strings 🔎 search params 🔀 shortlinks Check it out at unfurl.link! #DFIR #OSINT

On browser forensics in #DFIR: In news.sophos.com/en-us/2022/04/…, just from the URL we can see the attackers installed Chrome the week of 2021-11-01. So much interesting stuff in URLs! Unfurl 🔗: dfir.blog/unfurl/?url=hX… h/t Phill Moore for the article and lots of nice Google research

IP address in the URL? Sure, why not. You never know what you'll find in a URL (until you look 👀). 🔗dfir.blog/unfurl/?url=ht… #DFIR #OSINT

Related technical note -- if you ever find yourself wanting to do some forensics on a URL, play around with this helpful tool: dfir.blog/unfurl/ by Ryan Benson

Hey! Something looks familiar in this picture... #DFIR #OSINT

Have a long URL to decode? Use dfir.blog/unfurl/. It decodes parameters & values in the URL. Ex: I used Amazon & ran a search, copied URL, pasted into Unfurl. It broke the URL down & revealed "qid" param (2) is a time stamp and a date (3). #osint #cyber #tools

OSINT Techniques Unfurl.link does this too.