Skip to content

Instantly share code, notes, and snippets.

@jpmckinney
Last active September 25, 2015 22:09
Show Gist options
  • Select an option

  • Save jpmckinney/cd2fa9d91973746b8f3b to your computer and use it in GitHub Desktop.

Select an option

Save jpmckinney/cd2fa9d91973746b8f3b to your computer and use it in GitHub Desktop.
Notes on email unobfuscation

CloudFlare

# http://www.conservative.ca/team/member/?fname=Arnold&lname=Viersen&type=candidates
span = page.xpath('//span[@class="__cf_email__"]/@data-cfemail')
code = span[0]
operand = int(code[:2], 16)
return ''.join(chr(int(code[i:i + 2], 16) ^ operand) for i in range(2, len(code), 2))

ExpressionEngine

The two examples pages below seem to run different versions of ExpressionEngine.

# http://nslegislature.ca/index.php/people/members/patricia_arab
script = page.xpath('//dd/script/text()')
if script:
    codes = reversed(re.findall(r"]='(.+?)'", script[0]))
    content = ''.join(char(code) for code in codes)
    return re.search(r'>(.+)<', content).group(1)

# https://www.chp.ca/candidates/bow-river
script = page.xpath('//span[@class="email"]/script/text()')
if script:
    codes = reversed(re.findall(r"[\[,]'(.+?)'", script[0]))
    content = ''.join(char(code) for code in codes)
    return re.search(r'>E: (.+)<', content).group(1)

Joomla

# http://www.beaconsfield.ca/en/your-council.html
var = re.findall(r'var addy\d{4,5} = \'(.*)\'', script)[0].replace('\' + \'', '').replace('\'', '')
ext = re.findall(r'addy\d{4,5} = addy\d{4,5} \+ \'(.*);', script)[0].replace('\' + \'', '').replace('\'', '')
h = html_parser.HTMLParser()
return h.unescape(var + ext)
@jpmckinney
Copy link
Copy Markdown
Author

@tmtmtmtm: Thought you might like this (I also had to solve the CloudFlare obfuscation).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment