I wanted to share a neat API that works really well in InsightConnect, right now I’m accessing it via a REST plugin, but it could easily be converted into a plugin on its own. https://apiflash.com/ allows you to pass a URL to it and it returns a URL to a jpeg of a screenshot of the website.
This works great with InsightConnect because using the Markdown in an Artifact you can include this image.
It doesn’t follow all the links on the page like a JoeSandbox would, but we are using this to see what the links would look like in a Phishing Workflow.
Having it as an Artifact allows an analyst to quickly tell if a link is trying to look like a login page even if something like VirusTotal comes back clean.
Attached is an example Artifact showing today’s google page, hopefully someone will find this useful.
I just noticed there’s a plugin called “Screenshot a URL” that looks like it just went live this week (version 1.0.0 is 8/28/20). I haven’t kicked the tires on it yet, but it looks useful.
It’s actually that one tag and it’s not the same as the html version of an in-line b64 encoded image (html is <img src="data:image/png;base64, b64datagoeshere"/>)
When you say artifact, are you referring to a plain old artifact step (AKA a markdown card) in the workflow? If you want to include the contents of that in your Slack response, you can select the “Artifact Name.content” step variable when configuring your Slack Post Message step. It would look something like this in the Message box:
Looking into this a little more, the Post Message action does have the Attachments input where you pass in JSON to add more stuff to your message. If you look at their docs they have some example JSON that includes an image, though I haven’t tested it myself.
I have been able to send screenshots to teams using an image url in the markdown syntax  then converting the markdown to html (like in the screenshot starting this thread). The problem is that this plugin requires the <img64: syntax in the artifact and not the <img src="data:image/png;base64, one that Teams is expecting (like Elijah pointed out)
Sorry if I’m revisiting this old topic, I’m using the “Screenshot a URL” and “Base64” plugins, I’d like to insert an image into a Markdown, but I can’t figure out how to do it.
