November 27, 2017 Omer Ramić Tools & projects

Term obfuscation represents something that is written in a such way it is hard to understand what it do or represents.

More about the term obfuscation read here:
Encryption vs encoding vs hashing vs obfuscation

So if we want to easily understand obfuscated value or what was written we need to deobfuscate it.

Example of deobfuscation
Let's say you are an administrator or cyber security officer and you deal with cyber attacks on a daily basis, finding exploits, recognizing requests which hold obfuscated/hidden value of IP address (best example would be phishing attack).

Huge number of people is not aware and doesn't know that IP addresses can be written in a multiple forms and even than resolve/work perfectly.

Examples of obfuscated IP addresses for IPv4 216.58.212.36 would be:
3627734052
00000000330.0000000072.00000000324.0000000044
0xd8.0x3a.0xd4.36
0330.3855396 etc.

Usage of script is really simple. You can extend script to deobfuscate entire lists of obfuscated IP addresses or you can use it on a single obfuscated IP address individually as shown bellow.

More about IP obfuscation with it's equivalent can be found here:
Hide/obfuscate IP address in plain text with obfuscated equivalent

It is very easy to use this script, enter value you want to deobfuscate and run it:
./IP-Deobfuscator.py --ip 0330.0x3a.54308

Link to script on GitHub

Deobfuskacija IP adrese - korištenje