Parsing CloudFlare-protected emails

[Ruri]

Sometimes on websites you see something like this

<a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="LONG HEX STRING HERE">[email&#160;protected]</a>

In order to decrypt it, you can make use of the Jint interpreter and write this LoliScript piece of code:

PARSE "<SOURCE>" LR "cfemail=\"" "\"" -> VAR "LONGHEX"

## DECODING
BEGIN SCRIPT JavaScript
function cfDecodeEmail(encodedString) {
    var email = "", r = parseInt(encodedString.substr(0, 2), 16), n, i;
    for (n = 2; encodedString.length - n; n += 2){
    	i = parseInt(encodedString.substr(n, 2), 16) ^ r;
		email += String.fromCharCode(i);
    }
    return email;
}

var EMAIL = cfDecodeEmail(LONGHEX);
END SCRIPT -> VARS "EMAIL"
PRINT <EMAIL>

It will print the email in cleartext ^_^

[Kermit]

thanks

[B1rdY]

very useful
take note yall

[mega_1]

Noted.... Tnx Ruri

[BULMADB]

lets say there is bunch of email in single page is it possible to split the capture so they can become like
LONG HEX STRING HERE
LONG HEX STRING HERE
LONG HEX STRING HERE
LONG HEX STRING HERE

and make ur script do his job ?

[Ruri]

You simply need to parse recursively into an array and then pass the array to the js, it should be automatically converted to a js array and you can execute the function multiple times and return the output array. If that doesn't work, simply join the list into a single string using the UTILITY List Join function and pass the string, then split it again into the js, perform the operations, join it again, return it, and then split it using UTILITY Variable Split.

[BULMADB]

thank you so much

[Sawu_]

This post is deleted!

[King_Kong]

@Ruri I want to ask parseInt, String.fromCharCode, substr are these OB function or C#
Sorry I get it these are Javascript functions I think.
If I want to convert that script into C# or VB.net then how does the code look like?

[Ruri]

@King_Kong maybe if I have some time I'll write you a script tonight

[King_Kong]

@Ruri Thanks man for your efforts