# swisskit-sabotage

Poisons SwissPass phishing kits with realistic fake submissions. It generates
bogus identities and Luhn-valid card numbers and posts them to the kit's login
and billing endpoints, so the credentials the kit harvests are worthless.

## What it does

1. Generates a fake Swiss person (name via Faker `de_CH`, birth date, AHV/AVS
   number with a valid EAN-13 check digit).
2. Generates a fake card (Visa / Mastercard / Amex, Luhn-valid, future expiry).
3. Submits the login step, then the billing step, with randomized delays,
   rotated `User-Agent` (via `fake-useragent`) and `Accept-Language`.
4. Writes every submission to `sabotage_data.csv` and logs to `sabotage.log`.

## Requirements

- Python 3.10+
- Dependencies in `requirements.txt` (`requests`, `Faker`, `fake-useragent`),
  installed into a local `.venv` by `run.sh`.

## Run

`run.sh` creates the venv on first use, installs dependencies, and runs the tool:

```sh
./run.sh --target https://example-kit.tld --count 20
```

Or point it at the target with an env var instead of a flag:

```sh
SABOTAGE_TARGET=https://example-kit.tld ./run.sh --count 20
```

Manual venv, if you prefer:

```sh
python3 -m venv .venv
.venv/bin/pip install -r requirements.txt
.venv/bin/python sabotage-swisskit-phishing.py --target https://example-kit.tld
```

## Options

| Flag | Default | Meaning |
|------|---------|---------|
| `--target URL` | `$SABOTAGE_TARGET` | Kit base URL (required unless env var is set) |
| `--count N` | `10` | Number of entries to submit |
| `--delay SECONDS` | `2.0` | Baseline delay between steps; each step is jittered +/-50% |
| `--selftest` | | Validate the Luhn and AHV generators, then exit |

## Output

- `sabotage_data.csv` - one row per entry: AHV number, name, DOB, card, expiry,
  CVV, brand, bank, and login/billing status.
- `sabotage.log` - timestamped run log.

Both are gitignored and overwritten on each run.

## Tuning for a different kit

The endpoints and wire field names live in the **kit contract** block at the top
of `sabotage-swisskit-phishing.py`:

```python
LOGIN_PATH = "/login/"
BILLING_PATH = "/billing/"
FIELD_REF = "rv_nr"
```

Change these to match the target kit; the rest of the logic is kit-agnostic.
The billing payload's other field names (`card_action`, `vorname`, `nachname`,
`gebdatum`, `cardnum`, `expiry`, `cvv`, `brand`, `bank`) mirror the kit's form
and may also need adjusting.

## Self-test

```sh
./run.sh --selftest
```

Verifies generated card numbers pass the Luhn checksum and AHV numbers pass the
EAN-13 checksum.

## Authorized use only

This tool sends unsolicited form submissions to a remote host. Only run it
against a phishing kit you own, operate, or are explicitly authorized to act
against (for example an approved anti-phishing engagement). Running it against
a system you do not control may be illegal.