#unfurl — Public Fediverse posts

saving pineapple

saving pineapple 
skin, with dried hibiscus petals, 
ready to unfurl
.
20260705:1900
y

CVE Alert: CVE-2026-40036 - obsidianforensics - unfurl - https://www.redpacketsecurity.com/cve-alert-cve-2026-40036-obsidianforensics-unfurl/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-40036 #obsidianforensics #unfurl

Have a big number (or hex value) you found and think might be a timestamp? Drop it in `unfurl` in the terminal and see what comes out!

(add -d or --detailed if you want the type of timestamp, or run without it if you just want the value)

#DFIR #BF4SA #Unfurl 🌿

We could learn fr #CoryDoctorow 🏆
1. Our #fediverse is great for safe & private networking: "no #characterlimit" is also a boon.
2. But, can fediversers take the exemplary practice of @pluralistic who habitually uses #unfurl or collapsible buttons to hide #longtoots or long threads? I've followed Cory for years but not every post may be of immediate interest, so he's very kind with this habit imho.🙏
3. Sorry, fediversers making long posts without unfurl buttons often get #muted - is it only me?🤔

Over the winter holiday, I was watching Netflix's Carry-On and got a bit nerd-sniped by a real Google Search URL on-screen... and then proceeded to "authenticate" it.

https://dfir.blog/authenticating-screenshots-from-netflix-carry-on-movie/

#DFIR #OSINT #Unfurl #Netflix

Another new Unfurl feature is parsing DoH (DNS over HTTPS) requests! I haven't run into these often in URLs, but hey, it's nice that Unfurl can parse them for you if you do!

Example: https://dfir.blog/unfurl/?url=https://dnsserver.example.net/dns-query?dns=AAABAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB

#DFIR #Unfurl #OSINT

Unfurl can parse JSON Web Tokens!

At the highest level, JWTs have three parts: header, payload, and signature. Unfurl first splits a #JWT into those three components, then base64-decodes the header and payload, then parses the resulting JSON objects. While Unfurl could parse all that in one step, it does it in three steps to keep with the "show your work" spirit of the tool.

Here's an example: https://dfir.blog/unfurl/?url=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJsb2dnZWRJbkFzIjoiYWRtaW4iLCJpYXQiOjE0MjI3Nzk2Mzh9.gzSraSYS8EXBxLN_oWnFSRgCzcmJmMjLiuyu5CSpyHI

#DFIR #Unfurl #OSINT

A new Unfurl release is here! v2023.09 adds new features and some fixes. The release adds:
🔹 Parsing of JWTs (JSON Web Tokens)
🔹 Parsing of DoH (DNS over HTTPS) URLs
🔹 More recognized #Mastodon servers

Blog post with more details: https://dfir.blog/unfurl-parsing-jwt-and-doh/

#DFIR #Unfurl #OSINT

ULID (Universally Unique Lexicographically Sortable Identifier) is another ❄️-like timestamp (and Unfurl 🌿 can extract the timestamp from them).

Example: 01ARZ3NDEKTSV4RRFFQ69G5FAV

ULID Features:
🔹 Sortable
🔹 26 chars vs UUID's 36
🔹 Larger timestamp range

🔗 ULID Spec: https://github.com/ulid/spec
🔗 Unfurl example: https://dfir.blog/unfurl/?url=01ARZ3NDEKTSV4RRFFQ69G5FAV

#DFIR #Unfurl

Why do we care about timestamps embedded in UUIDs?

A UUIDv1 timestamp often correlates with when the object it represents was created. Extracting this timestamp gives us another point in our timeline (or just more context).

For example, the timestamp from the UUID in this GitHub image = time of image upload ⏰

Unfurl: https://dfir.blog/unfurl/?url=https://repository-images.githubusercontent.com/219613650/92534a80-17ab-11ea-9217-fe06f144cdb2?width=441&height=110

#DFIR #OSINT #Unfurl

Another service with timestamps embedded in IDs is #Discord.

A typical Discord message URL contains three IDs, and thus three timestamps. We can extract when the server, channel, and message were created ⏰.

Unfurl example: https://dfir.blog/unfurl/?url=https://discordapp.com/channels/427876741990711298/537760691302563843/643183730227281931
Discord reference: https://discord.com/developers/docs/reference#snowflakes

#DFIR #Unfurl

Learn how to break down URLs for digital forensics cases using Ryan Benson's Unfurl tool. Our latest podcast episode explores this vital tool, discusses Apple's CSAM debate, and much more!

https://digitalforensicsnow.buzzsprout.com/

#ForensicTools #Unfurl #DigitalForensics #MobileForensics

Toots and tweets aren't the only IDs with embedded timestamps... #TikTok IDs have them too!

TikTok uses these IDs in many places - to uniquely identify videos, accounts, and more. This means if you have the ID for any of these, you can tell when it was generated. For a video, that's effectively when it was posted, and for an account, that's when it was created.

And since this is all contained within the ID itself (no APIs or external lookups required), it works just as well for deleted or private items!

If you'd like to learn more, I wrote a peer-reviewed paper on this topic ("Tinkering with TikTok Timestamps") at the DFIR Review:
🔗 https://dfir.pubpub.org/pub/9llea7yp/release/1

And of course, Unfurl can parse TikTok IDs as well:
🔗 https://dfir.blog/unfurl/?url=https://www.tiktok.com/@billnye/video/6854717870488702213?lang=en

#DFIR #OSINT #Unfurl

A useful thing for analysis of #Twitter activity was that each tweet has the time in was created embedded in the ID - and #Unfurl can extract it!

Like tweets, #Mastodon IDs also have embedded timestamps in them, and Unfurl can parse them:

🔗 https://dfir.blog/unfurl/?url=https://infosec.exchange/@RyanDFIR/110968271932496136

This means that as long as you have the URL of the tweet/toot, you can determine when it was posted - even if it has been deleted or made private!

#DFIR #OSINT

Here's a fun example showing Unfurl parsing a link from a #Substack email. It features:
🇺 - Separating the URL into its components
🔗 - Expanding a shortlink
UU - Identifying a UUID
❄️ - Extracting a timestamp from a #Twitter ID (snowflake)
@ - Explaining a Twitter URL parameter
👀 - Explaining common analytics parameters
🕓 - Decoding a timestamp to human-readable form

There's more in there, too! It's amazing how much can be extracted from a URL!

#DFIR #OSINT #Unfurl

I haven't posted much about Unfurl lately (or anything really - a lot going on) but I want to change that!

Unfurl is an open source tool that takes a URL and expands ("unfurls") it into a directed graph. It primarily functions on information encoded in the URL itself - explaining what different parameters mean, identifying things like timestamps and different IDs, and site-specific parsers - but it also can do a few remote lookups.

GitHub: https://github.com/obsidianforensics/unfurl
Online version: https://dfir.blog/unfurl/

#DFIR #OSINT #Unfurl 🌿