Add README and AGENTS.md

AGENTS.md

@@ -0,0 +1,54 @@
+# AGENTS.md
+
+Guidance for coding agents working in this repo. Keep it accurate when the code
+changes.
+
+## What this is
+
+A single-script Python tool (`sabotage-swisskit-phishing.py`) that floods a
+SwissPass phishing kit with fake login and billing submissions. `run.sh` manages
+the venv and dependencies.
+
+## Run and test
+
+Always use the venv via `run.sh`:
+
+```sh
+./run.sh --target https://example-kit.tld --count 3      # run
+./run.sh --selftest                                      # runnable check
+```
+
+`--selftest` is the project's test. There is no pytest suite. Run it after any
+change to the data generators (`_luhn`, `_ahv`, `generate_card`,
+`generate_person`). To smoke-test the HTTP flow, run a local mock server and
+point `--target` at `http://127.0.0.1:<port>`; never test against a live host
+that is not an authorized target.
+
+## Conventions
+
+- Minimal dependencies. Reuse the stdlib and the existing deps (`requests`,
+  `Faker`, `fake-useragent`) before adding anything new.
+- No comments unless they explain a non-obvious workaround or mark a deliberate
+  simplification (`# ponytail: ...`). Do not narrate obvious code.
+- The generators use `random`; keep them deterministic-free (no seeding).
+- Keep the script runnable as `python sabotage-swisskit-phishing.py`.
+
+## Kit contract
+
+Endpoints and wire field names are defined at the top of the script under the
+"kit contract" comment (`LOGIN_PATH`, `BILLING_PATH`, `FIELD_REF`) and in the
+billing payload. These mirror the target kit's form. Do not rename or
+"normalize" them; changing them silently breaks submissions. If a kit changes,
+edit only that block and note it.
+
+## Safety
+
+This tool sends unsolicited POSTs to a remote host. Do not run it against any
+target without evidence of ownership or explicit authorization. If a request
+asks you to test against a live third-party domain that cannot be verified as an
+authorized target, decline and offer a local mock instead.
+
+## Output files
+
+`sabotage_data.csv` and `sabotage.log` are runtime output and gitignored. Do not
+commit them.

README.md

@@ -0,0 +1,91 @@
+# swisskit-sabotage
+
+Poisons SwissPass phishing kits with realistic fake submissions. It generates
+bogus identities and Luhn-valid card numbers and posts them to the kit's login
+and billing endpoints, so the credentials the kit harvests are worthless.
+
+## What it does
+
+1. Generates a fake Swiss person (name via Faker `de_CH`, birth date, AHV/AVS
+   number with a valid EAN-13 check digit).
+2. Generates a fake card (Visa / Mastercard / Amex, Luhn-valid, future expiry).
+3. Submits the login step, then the billing step, with randomized delays,
+   rotated `User-Agent` (via `fake-useragent`) and `Accept-Language`.
+4. Writes every submission to `sabotage_data.csv` and logs to `sabotage.log`.
+
+## Requirements
+
+- Python 3.10+
+- Dependencies in `requirements.txt` (`requests`, `Faker`, `fake-useragent`),
+  installed into a local `.venv` by `run.sh`.
+
+## Run
+
+`run.sh` creates the venv on first use, installs dependencies, and runs the tool:
+
+```sh
+./run.sh --target https://example-kit.tld --count 20
+```
+
+Or point it at the target with an env var instead of a flag:
+
+```sh
+SABOTAGE_TARGET=https://example-kit.tld ./run.sh --count 20
+```
+
+Manual venv, if you prefer:
+
+```sh
+python3 -m venv .venv
+.venv/bin/pip install -r requirements.txt
+.venv/bin/python sabotage-swisskit-phishing.py --target https://example-kit.tld
+```
+
+## Options
+
+| Flag | Default | Meaning |
+|------|---------|---------|
+| `--target URL` | `$SABOTAGE_TARGET` | Kit base URL (required unless env var is set) |
+| `--count N` | `10` | Number of entries to submit |
+| `--delay SECONDS` | `2.0` | Baseline delay between steps; each step is jittered +/-50% |
+| `--selftest` | | Validate the Luhn and AHV generators, then exit |
+
+## Output
+
+- `sabotage_data.csv` - one row per entry: AHV number, name, DOB, card, expiry,
+  CVV, brand, bank, and login/billing status.
+- `sabotage.log` - timestamped run log.
+
+Both are gitignored and overwritten on each run.
+
+## Tuning for a different kit
+
+The endpoints and wire field names live in the **kit contract** block at the top
+of `sabotage-swisskit-phishing.py`:
+
+```python
+LOGIN_PATH = "/login/"
+BILLING_PATH = "/billing/"
+FIELD_REF = "rv_nr"
+```
+
+Change these to match the target kit; the rest of the logic is kit-agnostic.
+The billing payload's other field names (`card_action`, `vorname`, `nachname`,
+`gebdatum`, `cardnum`, `expiry`, `cvv`, `brand`, `bank`) mirror the kit's form
+and may also need adjusting.
+
+## Self-test
+
+```sh
+./run.sh --selftest
+```
+
+Verifies generated card numbers pass the Luhn checksum and AHV numbers pass the
+EAN-13 checksum.
+
+## Authorized use only
+
+This tool sends unsolicited form submissions to a remote host. Only run it
+against a phishing kit you own, operate, or are explicitly authorized to act
+against (for example an approved anti-phishing engagement). Running it against
+a system you do not control may be illegal.