Learning objectives
- Extract indicators from surrounding text
- Distinguish normalization from validation
- Defang and refang without navigating
- Parse URI and IPv6 structure locally
- Explain why decoded or restored values remain untrusted
Lab A: report-safe URLs
Install Extract and defang URLs. Add a duplicate URL and verify that the output remains unique.
Then use Restore a defanged URL followed by Parse a URI. The workflow reconstructs syntax and displays fields; it does not request the destination.
Lab B: address extraction
Install Extract and defang IP addresses. Add one private IPv4 address and test the extractor’s option to remove local ranges.
Lab C: IPv6 structure
Open Inspect a Teredo IPv6 address. Compare its parsed fields with a documentation address such as 2001:db8::1.
Safety boundary
This course deliberately excludes operations that call external services, including HTTP Request, DNS over HTTPS, and map tiles. Extraction, parsing, defanging, and formatting run locally in the page.
Assignment
Write a synthetic alert containing repeated URLs, IPv4 addresses, an IPv6 address, and unrelated prose. Produce two outputs:
- A sorted, defanged indicator list for a report
- A parsed URI record for one synthetic URL
Document which values were normalized but not independently verified.