API
POST plain text, get it back transformed. Same Rust-compiled-to-wasm code as the boxes on the front page, running in a Cloudflare Worker.
Heads up: unlike the front page, which does everything
locally in your browser, the API sends your text over the network. It
transits Cloudflare's edge and could wind up in server logs along the
way. For genuinely sensitive IOC lists, use the boxes on the
front page — those never leave your machine.
Endpoints
POST /api/defang — defangs the raw request body.
$ curl --data-binary 'http://evil.example.com' https://dfang.sh/api/defang
hxxp[://]evil[.]example[.]comPOST /api/refang — puts the bite back.
$ curl --data-binary 'hxxp[://]evil[.]example[.]com' https://dfang.sh/api/refang
http://evil.example.comMulti-line bodies work, so you can pipe a whole file through:
$ curl --data-binary @iocs.txt https://dfang.sh/api/defangBehavior
- The request body is treated as raw UTF-8 text; the content type header is ignored.
- Responses are
text/plain; charset=utf-8. - CORS is wide open, so you can call it from browser code on any origin.
- Bodies are capped at 1,000,000 characters — larger requests get a
413. - Non-POST requests get a
405; unknown/apipaths get a404. - Nothing is stored, and there is no auth, no rate key, no tracking.
Keep it local
Want the API without the network hop? The whole site, API included, ships as a Docker image you can run on your own machine or homelab:
$ docker run -p 8080:8080 ghcr.io/patricktulskie/dfang-web:latest