# AGENTS.md

Guidance for coding agents working in this repo. Keep it accurate when the code
changes.

## What this is

A single-script Python tool (`sabotage-swisskit-phishing.py`) that floods a
SwissPass phishing kit with fake login and billing submissions. `run.sh` manages
the venv and dependencies.

## Run and test

Always use the venv via `run.sh`:

```sh
./run.sh --target https://example-kit.tld --count 3      # run
./run.sh --selftest                                      # runnable check
```

`--selftest` is the project's test. There is no pytest suite. Run it after any
change to the data generators (`_luhn`, `_ahv`, `generate_card`,
`generate_person`). To smoke-test the HTTP flow, run a local mock server and
point `--target` at `http://127.0.0.1:<port>`; never test against a live host
that is not an authorized target.

## Conventions

- Minimal dependencies. Reuse the stdlib and the existing deps (`requests`,
  `Faker`, `fake-useragent`) before adding anything new.
- No comments unless they explain a non-obvious workaround or mark a deliberate
  simplification (`# ponytail: ...`). Do not narrate obvious code.
- The generators use `random`; keep them deterministic-free (no seeding).
- Keep the script runnable as `python sabotage-swisskit-phishing.py`.

## Kit contract

Endpoints and wire field names are defined at the top of the script under the
"kit contract" comment (`LOGIN_PATH`, `BILLING_PATH`, `FIELD_REF`) and in the
billing payload. These mirror the target kit's form. Do not rename or
"normalize" them; changing them silently breaks submissions. If a kit changes,
edit only that block and note it.

## Safety

This tool sends unsolicited POSTs to a remote host. Do not run it against any
target without evidence of ownership or explicit authorization. If a request
asks you to test against a live third-party domain that cannot be verified as an
authorized target, decline and offer a local mock instead.

## Output files

`sabotage_data.csv` and `sabotage.log` are runtime output and gitignored. Do not
commit them.