Resolve Shortened Links in Bulk with PowerShell

Recently, I was working on a task that required resolving hundreds of shortened URLs that were being parsed by another script. Shortened URLs are often used to obscure or hide the actual location from a casual user in the hopes that they will click on it.

I needed something that could take pipeline input (objects passed from another script) and handle a variety of shortening services and was unable to find anything that met those requirements. Get-ShortenedURL is a PowerShell function that uses .Net to parse out the redirect URL (or more precisely the URI) and return it. Errors aren't really handled in a useful way, so you may want to add a "Write-Verbose" statement if you are interested in error handling.

Get-ShortenedURL FunctionFunction Get-ShortenedURL { <# .SYNOPSIS Get-ShortenedURL Author: Chris Campbell (@obscuresec) License: BSD 3-Clause .DESCRIPTION A function that returns the actual URL from a http redirect. .PARAMETER $ShortenedURL Specifies the shortened URL. .EXAMPLE PS C:\> Get-ShortenedURL -ShortenedURL http://goo.gl/V4PKq PS C:\> Get-ShortenedURL -ShortenedURL http://goo.gl/V4PKq,http://bit.ly/IeWSIZ PS C:\> Get-Content C:\urls.txt | Get-ShortenedURL PS C:\> Get-ShortenedURL -ShortenedURL (Get-Content C:\urls.txt) .LINK http://obscuresecurity.blogspot.com/2013/01/Get-ShortenedURL.html https://github.com/obscuresec/random/blob/master/Get-ShortenedURL #> [CmdletBinding()] Param( [Parameter(Mandatory=$True,ValueFromPipeline=$True)] [string[]] $ShortenedURL ) BEGIN {} PROCESS { Try { #Loop through each URL in the array Foreach ($URL in $ShortenedURL) { #Create the WebClient Object and request $WebClientObject = New-Object System.Net.WebClient $WebRequest = [System.Net.WebRequest]::create($URL) $WebResponse = $WebRequest.GetResponse() #Parse out redirected URL $ActualDownloadURL = $WebResponse.ResponseUri.AbsoluteUri #Create custom object to store results $ObjectProperties = @{ 'Shortened URL' = $URL; 'Actual URL' = $ActualDownloadURL} $ResultsObject = New-Object -TypeName PSObject -Property $ObjectProperties #Output the results Write-Output $ResultsObject #Close the webclient connection $WebResponse.Close() } } Catch {} } END {} }

There are serious OPSEC concerns with using this method when dealing with malware or targeted attacks. The script is going to leave a record that it resolved the URL.  There are services that can help with that and most shortening sites have an API which exposes the long URL. However, this can be used in a pinch to prevent being sent to a classic music video or to resolve bulk addresses.

-Chris