From e209de2a8830312fba528487608cffdc8c410615 Mon Sep 17 00:00:00 2001 From: StasonJatham Date: Mon, 21 Sep 2026 12:04:04 +0200 Subject: [PATCH] Expand AGENTS.md with run/monitor/use instructions --- AGENTS.md | 38 ++++++++++++++++++++++++++++++++++---- 1 file changed, 34 insertions(+), 4 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index e44e159..25f4eaf 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -9,21 +9,51 @@ A single-script Python tool (`sabotage-swisskit-phishing.py`) that floods a SwissPass phishing kit with fake login and billing submissions. `run.sh` manages the venv and dependencies. -## Run and test +## Running it -Always use the venv via `run.sh`: +Always use the venv via `run.sh` (creates `.venv`, installs deps, runs the tool): ```sh -./run.sh --target https://example-kit.tld --count 3 # run -./run.sh --selftest # runnable check +./run.sh --target https://example-kit.tld --count 20 # N entries +SABOTAGE_TARGET=https://example-kit.tld ./run.sh # target via env ``` +Flags: `--target URL` (or `SABOTAGE_TARGET`), `--count N` (default 10), +`--delay SECONDS` (default 2.0, jittered +/-50%), `--selftest`. Each entry does a +login POST then a billing POST, so `--count 20` is 40 requests. + +## Monitoring it + +The tool logs every step to stdout and to `sabotage.log`: + +```sh +tail -f sabotage.log # follow live +rg 'FAIL|SKIPPED' sabotage.log # find failures +column -s, -t sabotage_data.csv | less # inspect the data as it is written +``` + +Per-entry status: `login:OK/FAIL`, `billing:OK/FAIL/SKIPPED` (billing is +`SKIPPED` when login failed). The final line reports +`done: ok, failed`. Transient 5xx responses are retried +automatically; per-request network errors are logged as `POST ... failed` and +count as a failure. `Ctrl-C` stops cleanly and keeps the partial CSV. + +## Testing it + `--selftest` is the project's test. There is no pytest suite. Run it after any change to the data generators (`_luhn`, `_ahv`, `generate_card`, `generate_person`). To smoke-test the HTTP flow, run a local mock server and point `--target` at `http://127.0.0.1:`; never test against a live host that is not an authorized target. +## Using it + +1. Confirm the target is a phishing kit you own/operate/are authorized to hit. +2. Smoke-test the same code path against a local mock first. +3. Run a small batch (`--count 3`) and check `sabotage.log` for `OK`s. +4. Scale up `--count` / lower `--delay` once the flow is confirmed. +5. Point the kit contract at the target's form if the endpoints/fields differ. + ## Conventions - Minimal dependencies. Reuse the stdlib and the existing deps (`requests`,