
Credential-Phishing-Analyse und Automatisierung
Folien des Vortrags auf der CircleCityCon 2017
*Getestet auf Headless Ubuntu Server 16.04
usage: bucklegripper.py [-h] [-u URL] [-s SOURCE] [-r READFILE] [-a USERAGENT]
Visit a suspected phishing page, screenshot it and pillage it for phishing
archives
optional arguments:
-h, --help show this help message and exit
-u URL, --url URL Url to visit
-s SOURCE, --source SOURCE
Apply a source to where this url came from
-r READFILE, --readfile READFILE
Read in a file of URLs one per line
-a USERAGENT, --useragent USERAGENT
Custom User-Agent
Beispiel für das Einlesen einer einzelnen URL
$ python bucklegripper.py -s openphish -u http://www.govwebsearch.com/apc/opc/pdp/safe/optusnet.com.au/Login.html
.: BUCKLEGRIPPER v0.1 https://github.com/hadojae/DATA/ :.
[+] Processing http://www.govwebsearch.com/apc/opc/pdp/safe/optusnet.com.au/Login.html
[+] Screencapped http://www.govwebsearch.com/apc/opc/pdp/safe/optusnet.com.au/Login.html as 20170503-032950-openphish-www.govwebsearch.com.png
[+] Found Zip file at http://www.govwebsearch.com/apc/opc/pdp/safe/optusnet.com.au.zip
[+] Saved http://www.govwebsearch.com/apc/opc/pdp/safe/optusnet.com.au.zip as 20170503-032950-openphish-www.govwebsearch.com-optusnet.com.au.zip
[+] Found Opendir at http://www.govwebsearch.com/apc/opc/pdp/safe/optusnet.com.au/
[+] Found php file: http://www.govwebsearch.com/apc/opc/pdp/safe/optusnet.com.au/post.php
[+] Found Opendir at http://www.govwebsearch.com/apc/opc/pdp/safe/
[+] Saved http://www.govwebsearch.com/apc/opc/pdp/safe/optusnet.com.au.zip as 20170503-032951-openphish-www.govwebsearch.com-optusnet.com.au.zip
[+] Found Opendir at http://www.govwebsearch.com/apc/opc/pdp/
[+] Found Opendir at http://www.govwebsearch.com/apc/opc/
[+] Found Opendir at http://www.govwebsearch.com/apc/
Beispiel für das Einlesen einer Datei mit zeilenweise getrennten URLs
$ python bucklegripper.py -s openphish -r ../../test_urls.txt
.: BUCKLEGRIPPER v0.1 https://github.com/hadojae/DATA/ :.
[+] Beginning processing of ../../test_urls.txt
[+] Processing http://onjasela.net/DB/fr/
[+] Screencapped http://onjasela.net/DB/fr/ as 20170503-010034-openphish-onjasela.net.png
[+] Processing http://suesschool.com/yahoologin/yahoologin/clients/login.php
[+] Screencapped http://suesschool.com/yahoologin/yahoologin/clients/login.php as 20170503-010053-openphish-suesschool.com.png
[+] Found Opendir at http://suesschool.com/yahoologin/yahoologin/clients/
[+] Found php file: http://suesschool.com/yahoologin/yahoologin/clients/login.php
[+] Found php file: http://suesschool.com/yahoologin/yahoologin/clients/data.php
[+] Found php file: http://suesschool.com/yahoologin/yahoologin/clients/block.php
[+] Found Opendir at http://suesschool.com/yahoologin/yahoologin/
[+] Found php file: http://suesschool.com/yahoologin/yahoologin/login.php
[+] Found php file: http://suesschool.com/yahoologin/yahoologin/data.php
[+] Found php file: http://suesschool.com/yahoologin/yahoologin/block.php
[+] Found Zip file at http://suesschool.com/yahoologin.zip
[+] Saved http://suesschool.com/yahoologin.zip as 20170503-010125-openphish-suesschool.com-yahoologin.zip
[+] Found Opendir at http://suesschool.com/yahoologin/
[+] Processing http://communitypartnersjc.org/wp-admin/js/index
[+] Screencapped http://communitypartnersjc.org/wp-admin/js/index as 20170503-010138-openphish-communitypartnersjc.org.png
[+] Processing http://ytrdesh.com/info/
[+] Screencapped http://ytrdesh.com/info/ as 20170503-010148-openphish-ytrdesh.com.png
...continues...
usage: bullyblinder.py [-h] -u URL [-a USERAGENT] -i INTERFACE
Visit a suspected phishing page and attempt form filling while getting a pcap
optional arguments:
-h, --help show this help message and exit
-u URL, --url URL Url to visit
-a USERAGENT, --useragent USERAGENT
Custom User-Agent to use
-i INTERFACE, --interface INTERFACE
Interface to tell tshark to listen on
Beispiel zur Verwendung
$ python bullyblinder.py -i eth0 -u http://www.justpropertydevelopers.com/scanned
.: BULLYBLINDER v0.1 https://github.com/hadojae/DATA/ :.
[+] Preparing pcap: 20170503-033243-www.justpropertydevelopers.com.pcap
[+] Processing http://www.justpropertydevelopers.com/scanned
[+] Submitting POST
[+] Control: <HiddenControl(hidCflag=1)>, Control.Type: hidden, Control.Name: hidCflag, Control.ID: hidCflag
[+] Control: <SelectControl(<None>=[])>, Control.Type: select, Control.Name: None, Control.ID: None
[+] Control: <SelectControl(<None>=[*0])>, Control.Type: select, Control.Name: None, Control.ID: None
[+] Control: <SelectControl(<None>=[*1])>, Control.Type: select, Control.Name: None, Control.ID: None
[+] Control: <SelectControl(<None>=[*2])>, Control.Type: select, Control.Name: None, Control.ID: None
[+] Control: <SelectControl(<None>=[*3])>, Control.Type: select, Control.Name: None, Control.ID: None
[+] Control: <SelectControl(<None>=[*4])>, Control.Type: select, Control.Name: None, Control.ID: None
[+] Control: <TextControl([email protected])>, Control.Type: email, Control.Name: Email, Control.ID: Email
[+] Control: <PasswordControl(Passwd=696969)>, Control.Type: password, Control.Name: Passwd, Control.ID: Passwd
[+] Control: <SubmitControl(signIn=Sign in to view attachment) (readonly)>, Control.Type: submit, Control.Name: signIn, Control.ID: signIn
[+] Control: <CheckboxControl(PersistentCookie=[yes])>, Control.Type: checkbox, Control.Name: PersistentCookie, Control.ID: PersistentCookie
[+] Control: <HiddenControl(rmShown=1) (readonly)>, Control.Type: hidden, Control.Name: rmShown, Control.ID: None
[-] No form found, checking for redirectors and obfuscation.
[+] Found js window.location or document.location, processing the redir
[+] https://drive.google.com/#my-drive appears to be a legitimate website.
[+] Complete! Submitted 1 form(s)
[+] Url Request Chain:
http://justpropertydevelopers.com/scan/docg/doc/filewords/index.php
--http://justpropertydevelopers.com/scan/docg/doc/filewords/index.php
Beispiel zur Verwendung
$ ./slickshoes.sh ~/PDFs/
http://4cgemstones.com/polaiowpwwww/GD/index.php
http://80bpm.net/invoice-17524-Apr-26-2017-US-048591/
http://acheirapido.com.br/arquivos/pdf/
http://adams-kuwait.com/REview/office
http://rfaprojects.co.uk/invoice-80633-Apr-24-2017-US-665952/
http://sacm.net/SCANNED/ZN3747CGMSCWC/
https://geloscubinho.com.br/cgi/pdf/index.php
http://afriquecalabashsafaris.com/layouts/GD/index.php
http://akukoomole.com/AdobeLogin/index.php
...continues...
*PINCHERSOFPERIL und BULLYBUSTER sind in Arbeit
DATA-Skripte sind eine ständige Baustelle. Feedback, Probleme und Ergänzungen sind willkommen.
Richtige Python-Pakete werden erstellt, sobald ausreichend Tests und Funktionen hinzugefügt und mehr Fehler behoben wurden.
Stellen Sie sicher, dass Sie die neuesten Versionen von Firefox, Selenium und Mechanize verwenden. Selenium und Mechanize können über pip aktualisiert werden.
sudo apt-get update && sudo apt-get install firefox
sudo pip install mechanize --upgrade
sudo pip install selenium --upgrade
Die getestete aktuelle Version von geckodriver ist v0.19.1.
Wenn Sie Probleme beim Schreiben von pcaps haben, verwenden Sie dies, um die dumpcap-Berechtigungen zu korrigieren (bei Verwendung einiger VPS beobachtet).
sudo chgrp YOUR_USER /usr/bin/dumpcap
sudo chmod 750 /usr/bin/dumpcap
sudo setcap cap_net_raw,cap_net_admin+eip /usr/bin/dumpcap
Stellen Sie sicher, dass Sie NIC-Funktionen deaktivieren, wenn Sie Datenverkehr aufzeichnen. Führen Sie dies als root aus. Prüfsummenfehler verursachen allerlei Albträume.
# for i in rx tx sg tso ufo gso gro lro; do ethtool -K eth0 $i off; done