91 lines
2.8 KiB
Markdown
91 lines
2.8 KiB
Markdown
|
# swisskit-sabotage
|
||
|
|
|
||
|
|
Poisons SwissPass phishing kits with realistic fake submissions. It generates
|
||
|
|
bogus identities and Luhn-valid card numbers and posts them to the kit's login
|
||
|
|
and billing endpoints, so the credentials the kit harvests are worthless.
|
||
|
|
|
||
|
|
## What it does
|
||
|
|
|
||
|
|
1. Generates a fake Swiss person (name via Faker `de_CH`, birth date, AHV/AVS
|
||
|
|
number with a valid EAN-13 check digit).
|
||
|
|
2. Generates a fake card (Visa / Mastercard / Amex, Luhn-valid, future expiry).
|
||
|
|
3. Submits the login step, then the billing step, with randomized delays,
|
||
|
|
rotated `User-Agent` (via `fake-useragent`) and `Accept-Language`.
|
||
|
|
4. Writes every submission to `sabotage_data.csv` and logs to `sabotage.log`.
|
||
|
|
|
||
|
|
## Requirements
|
||
|
|
|
||
|
|
- Python 3.10+
|
||
|
|
- Dependencies in `requirements.txt` (`requests`, `Faker`, `fake-useragent`),
|
||
|
|
installed into a local `.venv` by `run.sh`.
|
||
|
|
|
||
|
|
## Run
|
||
|
|
|
||
|
|
`run.sh` creates the venv on first use, installs dependencies, and runs the tool:
|
||
|
|
|
||
|
|
```sh
|
||
|
|
./run.sh --target https://example-kit.tld --count 20
|
||
|
|
```
|
||
|
|
|
||
|
|
Or point it at the target with an env var instead of a flag:
|
||
|
|
|
||
|
|
```sh
|
||
|
|
SABOTAGE_TARGET=https://example-kit.tld ./run.sh --count 20
|
||
|
|
```
|
||
|
|
|
||
|
|
Manual venv, if you prefer:
|
||
|
|
|
||
|
|
```sh
|
||
|
|
python3 -m venv .venv
|
||
|
|
.venv/bin/pip install -r requirements.txt
|
||
|
|
.venv/bin/python sabotage-swisskit-phishing.py --target https://example-kit.tld
|
||
|
|
```
|
||
|
|
|
||
|
|
## Options
|
||
|
|
|
||
|
|
| Flag | Default | Meaning |
|
||
|
|
|------|---------|---------|
|
||
|
|
| `--target URL` | `$SABOTAGE_TARGET` | Kit base URL (required unless env var is set) |
|
||
|
|
| `--count N` | `10` | Number of entries to submit |
|
||
|
|
| `--delay SECONDS` | `2.0` | Baseline delay between steps; each step is jittered +/-50% |
|
||
|
|
| `--selftest` | | Validate the Luhn and AHV generators, then exit |
|
||
|
|
|
||
|
|
## Output
|
||
|
|
|
||
|
|
- `sabotage_data.csv` - one row per entry: AHV number, name, DOB, card, expiry,
|
||
|
|
CVV, brand, bank, and login/billing status.
|
||
|
|
- `sabotage.log` - timestamped run log.
|
||
|
|
|
||
|
|
Both are gitignored and overwritten on each run.
|
||
|
|
|
||
|
|
## Tuning for a different kit
|
||
|
|
|
||
|
|
The endpoints and wire field names live in the **kit contract** block at the top
|
||
|
|
of `sabotage-swisskit-phishing.py`:
|
||
|
|
|
||
|
|
```python
|
||
|
|
LOGIN_PATH = "/login/"
|
||
|
|
BILLING_PATH = "/billing/"
|
||
|
|
FIELD_REF = "rv_nr"
|
||
|
|
```
|
||
|
|
|
||
|
|
Change these to match the target kit; the rest of the logic is kit-agnostic.
|
||
|
|
The billing payload's other field names (`card_action`, `vorname`, `nachname`,
|
||
|
|
`gebdatum`, `cardnum`, `expiry`, `cvv`, `brand`, `bank`) mirror the kit's form
|
||
|
|
and may also need adjusting.
|
||
|
|
|
||
|
|
## Self-test
|
||
|
|
|
||
|
|
```sh
|
||
|
|
./run.sh --selftest
|
||
|
|
```
|
||
|
|
|
||
|
|
Verifies generated card numbers pass the Luhn checksum and AHV numbers pass the
|
||
|
|
EAN-13 checksum.
|
||
|
|
|
||
|
|
## Authorized use only
|
||
|
|
|
||
|
|
This tool sends unsolicited form submissions to a remote host. Only run it
|
||
|
|
against a phishing kit you own, operate, or are explicitly authorized to act
|
||
|
|
against (for example an approved anti-phishing engagement). Running it against
|
||
|
|
a system you do not control may be illegal.
|