From 6f4e74cce6bccaadd45880f6bc20e71360db9e98 Mon Sep 17 00:00:00 2001 From: StasonJatham Date: Mon, 21 Sep 2026 12:03:31 +0200 Subject: [PATCH] Add README and AGENTS.md --- AGENTS.md | 54 +++++++++++++++++++++++++++++++++ README.md | 91 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 145 insertions(+) create mode 100644 AGENTS.md create mode 100644 README.md diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..e44e159 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,54 @@ +# AGENTS.md + +Guidance for coding agents working in this repo. Keep it accurate when the code +changes. + +## What this is + +A single-script Python tool (`sabotage-swisskit-phishing.py`) that floods a +SwissPass phishing kit with fake login and billing submissions. `run.sh` manages +the venv and dependencies. + +## Run and test + +Always use the venv via `run.sh`: + +```sh +./run.sh --target https://example-kit.tld --count 3 # run +./run.sh --selftest # runnable check +``` + +`--selftest` is the project's test. There is no pytest suite. Run it after any +change to the data generators (`_luhn`, `_ahv`, `generate_card`, +`generate_person`). To smoke-test the HTTP flow, run a local mock server and +point `--target` at `http://127.0.0.1:`; never test against a live host +that is not an authorized target. + +## Conventions + +- Minimal dependencies. Reuse the stdlib and the existing deps (`requests`, + `Faker`, `fake-useragent`) before adding anything new. +- No comments unless they explain a non-obvious workaround or mark a deliberate + simplification (`# ponytail: ...`). Do not narrate obvious code. +- The generators use `random`; keep them deterministic-free (no seeding). +- Keep the script runnable as `python sabotage-swisskit-phishing.py`. + +## Kit contract + +Endpoints and wire field names are defined at the top of the script under the +"kit contract" comment (`LOGIN_PATH`, `BILLING_PATH`, `FIELD_REF`) and in the +billing payload. These mirror the target kit's form. Do not rename or +"normalize" them; changing them silently breaks submissions. If a kit changes, +edit only that block and note it. + +## Safety + +This tool sends unsolicited POSTs to a remote host. Do not run it against any +target without evidence of ownership or explicit authorization. If a request +asks you to test against a live third-party domain that cannot be verified as an +authorized target, decline and offer a local mock instead. + +## Output files + +`sabotage_data.csv` and `sabotage.log` are runtime output and gitignored. Do not +commit them. diff --git a/README.md b/README.md new file mode 100644 index 0000000..7de1df1 --- /dev/null +++ b/README.md @@ -0,0 +1,91 @@ +# swisskit-sabotage + +Poisons SwissPass phishing kits with realistic fake submissions. It generates +bogus identities and Luhn-valid card numbers and posts them to the kit's login +and billing endpoints, so the credentials the kit harvests are worthless. + +## What it does + +1. Generates a fake Swiss person (name via Faker `de_CH`, birth date, AHV/AVS + number with a valid EAN-13 check digit). +2. Generates a fake card (Visa / Mastercard / Amex, Luhn-valid, future expiry). +3. Submits the login step, then the billing step, with randomized delays, + rotated `User-Agent` (via `fake-useragent`) and `Accept-Language`. +4. Writes every submission to `sabotage_data.csv` and logs to `sabotage.log`. + +## Requirements + +- Python 3.10+ +- Dependencies in `requirements.txt` (`requests`, `Faker`, `fake-useragent`), + installed into a local `.venv` by `run.sh`. + +## Run + +`run.sh` creates the venv on first use, installs dependencies, and runs the tool: + +```sh +./run.sh --target https://example-kit.tld --count 20 +``` + +Or point it at the target with an env var instead of a flag: + +```sh +SABOTAGE_TARGET=https://example-kit.tld ./run.sh --count 20 +``` + +Manual venv, if you prefer: + +```sh +python3 -m venv .venv +.venv/bin/pip install -r requirements.txt +.venv/bin/python sabotage-swisskit-phishing.py --target https://example-kit.tld +``` + +## Options + +| Flag | Default | Meaning | +|------|---------|---------| +| `--target URL` | `$SABOTAGE_TARGET` | Kit base URL (required unless env var is set) | +| `--count N` | `10` | Number of entries to submit | +| `--delay SECONDS` | `2.0` | Baseline delay between steps; each step is jittered +/-50% | +| `--selftest` | | Validate the Luhn and AHV generators, then exit | + +## Output + +- `sabotage_data.csv` - one row per entry: AHV number, name, DOB, card, expiry, + CVV, brand, bank, and login/billing status. +- `sabotage.log` - timestamped run log. + +Both are gitignored and overwritten on each run. + +## Tuning for a different kit + +The endpoints and wire field names live in the **kit contract** block at the top +of `sabotage-swisskit-phishing.py`: + +```python +LOGIN_PATH = "/login/" +BILLING_PATH = "/billing/" +FIELD_REF = "rv_nr" +``` + +Change these to match the target kit; the rest of the logic is kit-agnostic. +The billing payload's other field names (`card_action`, `vorname`, `nachname`, +`gebdatum`, `cardnum`, `expiry`, `cvv`, `brand`, `bank`) mirror the kit's form +and may also need adjusting. + +## Self-test + +```sh +./run.sh --selftest +``` + +Verifies generated card numbers pass the Luhn checksum and AHV numbers pass the +EAN-13 checksum. + +## Authorized use only + +This tool sends unsolicited form submissions to a remote host. Only run it +against a phishing kit you own, operate, or are explicitly authorized to act +against (for example an approved anti-phishing engagement). Running it against +a system you do not control may be illegal.