
Анализ фишинга учетных данных и автоматизация
Slides from presentation at CircleCityCon 2017
*Протестировано на Headless Ubuntu Server 16.04
usage: bucklegripper.py [-h] [-u URL] [-s SOURCE] [-r READFILE] [-a USERAGENT]
Visit a suspected phishing page, screenshot it and pillage it for phishing
archives
optional arguments:
-h, --help show this help message and exit
-u URL, --url URL Url to visit
-s SOURCE, --source SOURCE
Apply a source to where this url came from
-r READFILE, --readfile READFILE
Read in a file of URLs one per line
-a USERAGENT, --useragent USERAGENT
Custom User-Agent
Пример чтения одного URL
$ python bucklegripper.py -s openphish -u http://www.govwebsearch.com/apc/opc/pdp/safe/optusnet.com.au/Login.html
.: BUCKLEGRIPPER v0.1 https://github.com/hadojae/DATA/ :.
[+] Processing http://www.govwebsearch.com/apc/opc/pdp/safe/optusnet.com.au/Login.html
[+] Screencapped http://www.govwebsearch.com/apc/opc/pdp/safe/optusnet.com.au/Login.html as 20170503-032950-openphish-www.govwebsearch.com.png
[+] Found Zip file at http://www.govwebsearch.com/apc/opc/pdp/safe/optusnet.com.au.zip
[+] Saved http://www.govwebsearch.com/apc/opc/pdp/safe/optusnet.com.au.zip as 20170503-032950-openphish-www.govwebsearch.com-optusnet.com.au.zip
[+] Found Opendir at http://www.govwebsearch.com/apc/opc/pdp/safe/optusnet.com.au/
[+] Found php file: http://www.govwebsearch.com/apc/opc/pdp/safe/optusnet.com.au/post.php
[+] Found Opendir at http://www.govwebsearch.com/apc/opc/pdp/safe/
[+] Saved http://www.govwebsearch.com/apc/opc/pdp/safe/optusnet.com.au.zip as 20170503-032951-openphish-www.govwebsearch.com-optusnet.com.au.zip
[+] Found Opendir at http://www.govwebsearch.com/apc/opc/pdp/
[+] Found Opendir at http://www.govwebsearch.com/apc/opc/
[+] Found Opendir at http://www.govwebsearch.com/apc/
Пример чтения файла с URL, разделёнными строками
$ python bucklegripper.py -s openphish -r ../../test_urls.txt
.: BUCKLEGRIPPER v0.1 https://github.com/hadojae/DATA/ :.
[+] Beginning processing of ../../test_urls.txt
[+] Processing http://onjasela.net/DB/fr/
[+] Screencapped http://onjasela.net/DB/fr/ as 20170503-010034-openphish-onjasela.net.png
[+] Processing http://suesschool.com/yahoologin/yahoologin/clients/login.php
[+] Screencapped http://suesschool.com/yahoologin/yahoologin/clients/login.php as 20170503-010053-openphish-suesschool.com.png
[+] Found Opendir at http://suesschool.com/yahoologin/yahoologin/clients/
[+] Found php file: http://suesschool.com/yahoologin/yahoologin/clients/login.php
[+] Found php file: http://suesschool.com/yahoologin/yahoologin/clients/data.php
[+] Found php file: http://suesschool.com/yahoologin/yahoologin/clients/block.php
[+] Found Opendir at http://suesschool.com/yahoologin/yahoologin/
[+] Found php file: http://suesschool.com/yahoologin/yahoologin/login.php
[+] Found php file: http://suesschool.com/yahoologin/yahoologin/data.php
[+] Found php file: http://suesschool.com/yahoologin/yahoologin/block.php
[+] Found Zip file at http://suesschool.com/yahoologin.zip
[+] Saved http://suesschool.com/yahoologin.zip as 20170503-010125-openphish-suesschool.com-yahoologin.zip
[+] Found Opendir at http://suesschool.com/yahoologin/
[+] Processing http://communitypartnersjc.org/wp-admin/js/index
[+] Screencapped http://communitypartnersjc.org/wp-admin/js/index as 20170503-010138-openphish-communitypartnersjc.org.png
[+] Processing http://ytrdesh.com/info/
[+] Screencapped http://ytrdesh.com/info/ as 20170503-010148-openphish-ytrdesh.com.png
...продолжение...
usage: bullyblinder.py [-h] -u URL [-a USERAGENT] -i INTERFACE
Visit a suspected phishing page and attempt form filling while getting a pcap
optional arguments:
-h, --help show this help message and exit
-u URL, --url URL Url to visit
-a USERAGENT, --useragent USERAGENT
Custom User-Agent to use
-i INTERFACE, --interface INTERFACE
Interface to tell tshark to listen on
Пример использования
$ python bullyblinder.py -i eth0 -u http://www.justpropertydevelopers.com/scanned
.: BULLYBLINDER v0.1 https://github.com/hadojae/DATA/ :.
[+] Preparing pcap: 20170503-033243-www.justpropertydevelopers.com.pcap
[+] Processing http://www.justpropertydevelopers.com/scanned
[+] Submitting POST
[+] Control: <HiddenControl(hidCflag=1)>, Тип элемента: hidden, Имя элемента: hidCflag, ID элемента: hidCflag
[+] Control: <SelectControl(<None>=[])>, Тип элемента: select, Имя элемента: None, ID элемента: None
[+] Control: <SelectControl(<None>=[*0])>, Тип элемента: select, Имя элемента: None, ID элемента: None
[+] Control: <SelectControl(<None>=[*1])>, Тип элемента: select, Имя элемента: None, ID элемента: None
[+] Control: <SelectControl(<None>=[*2])>, Тип элемента: select, Имя элемента: None, ID элемента: None
[+] Control: <SelectControl(<None>=[*3])>, Тип элемента: select, Имя элемента: None, ID элемента: None
[+] Control: <SelectControl(<None>=[*4])>, Тип элемента: select, Имя элемента: None, ID элемента: None
[+] Control: <TextControl([email protected])>, Тип элемента: email, Имя элемента: Email, ID элемента: Email
[+] Control: <PasswordControl(Passwd=696969)>, Тип элемента: password, Имя элемента: Passwd, ID элемента: Passwd
[+] Control: <SubmitControl(signIn=Sign in to view attachment) (readonly)>, Тип элемента: submit, Имя элемента: signIn, ID элемента: signIn
[+] Control: <CheckboxControl(PersistentCookie=[yes])>, Тип элемента: checkbox, Имя элемента: PersistentCookie, ID элемента: PersistentCookie
[+] Control: <HiddenControl(rmShown=1) (readonly)>, Тип элемента: hidden, Имя элемента: rmShown, ID элемента: None
[-] Форма не найдена, проверка редиректоров и обфускации.
[+] Обнаружен js window.location или document.location, обрабатываем редирект
[+] https://drive.google.com/#my-drive выглядит как легитимный веб-сайт.
[+] Завершено! Отправлено 1 форма(ы)
[+] Цепочка запросов URL:
http://justpropertydevelopers.com/scan/docg/doc/filewords/index.php
--http://justpropertydevelopers.com/scan/docg/doc/filewords/index.php
Пример использования
$ ./slickshoes.sh ~/PDFs/
http://4cgemstones.com/polaiowpwwww/GD/index.php
http://80bpm.net/invoice-17524-Apr-26-2017-US-048591/
http://acheirapido.com.br/arquivos/pdf/
http://adams-kuwait.com/REview/office
http://rfaprojects.co.uk/invoice-80633-Apr-24-2017-US-665952/
http://sacm.net/SCANNED/ZN3747CGMSCWC/
https://geloscubinho.com.br/cgi/pdf/index.php
http://afriquecalabashsafaris.com/layouts/GD/index.php
http://akukoomole.com/AdobeLogin/index.php
...продолжение...
*PINCHERSOFPERIL и BULLYBUSTER в разработке
Скрипты DATA находятся в постоянной разработке. Приветствуются отзывы, сообщения об ошибках и дополнения.
Полноценные пакеты Python будут созданы после достаточного тестирования, добавления функций и исправления ошибок.
Убедитесь, что вы используете последние версии Firefox, Selenium и Mechanize. Selenium и Mechanize можно обновить через pip.
sudo apt-get update && sudo apt-get install firefox
sudo pip install mechanize --upgrade
sudo pip install selenium --upgrade
Текущая протестированная версия geckodriver — v0.19.1.
Если возникают проблемы с записью pcap, используйте это для исправления прав dumpcap (наблюдалось при использовании некоторых VPS)
sudo chgrp YOUR_USER /usr/bin/dumpcap
sudo chmod 750 /usr/bin/dumpcap
sudo setcap cap_net_raw,cap_net_admin+eip /usr/bin/dumpcap
Обязательно отключите функции сетевого интерфейса при захвате трафика, запустите это от root. Ошибки контрольной суммы вызовут всевозможные кошмары.
# for i in rx tx sg tso ufo gso gro lro; do ethtool -K eth0 $i off; done