swisskit-sabotage

Poisons SwissPass phishing kits with realistic fake submissions. It generates bogus identities and Luhn-valid card numbers and posts them to the kit's login and billing endpoints, so the credentials the kit harvests are worthless.

What it does

1. Generates a fake Swiss person (name via Faker de_CH, birth date, AHV/AVS number with a valid EAN-13 check digit).
2. Generates a fake card (Visa / Mastercard / Amex, Luhn-valid, future expiry).
3. Submits the login step, then the billing step, with randomized delays, rotated User-Agent (via fake-useragent) and Accept-Language.
4. Writes every submission to sabotage_data.csv and logs to sabotage.log.

Requirements

• Python 3.10+
• Dependencies in requirements.txt (requests, Faker, fake-useragent), installed into a local .venv by run.sh.

Run

run.sh creates the venv on first use, installs dependencies, and runs the tool:

./run.sh --target https://example-kit.tld --count 20

Or point it at the target with an env var instead of a flag:

SABOTAGE_TARGET=https://example-kit.tld ./run.sh --count 20

Manual venv, if you prefer:

python3 -m venv .venv
.venv/bin/pip install -r requirements.txt
.venv/bin/python sabotage-swisskit-phishing.py --target https://example-kit.tld

Options

Flag	Default	Meaning
--target URL	$SABOTAGE_TARGET	Kit base URL (required unless env var is set)
--count N	10	Number of entries to submit
--delay SECONDS	2.0	Baseline delay between steps; each step is jittered +/-50%
--selftest		Validate the Luhn and AHV generators, then exit

Output

• sabotage_data.csv - one row per entry: AHV number, name, DOB, card, expiry, CVV, brand, bank, and login/billing status.
• sabotage.log - timestamped run log.

Both are gitignored and overwritten on each run.

Tuning for a different kit

The endpoints and wire field names live in the kit contract block at the top of sabotage-swisskit-phishing.py:

LOGIN_PATH = "/login/"
BILLING_PATH = "/billing/"
FIELD_REF = "rv_nr"

Change these to match the target kit; the rest of the logic is kit-agnostic. The billing payload's other field names (card_action, vorname, nachname, gebdatum, cardnum, expiry, cvv, brand, bank) mirror the kit's form and may also need adjusting.

Self-test

./run.sh --selftest

Verifies generated card numbers pass the Luhn checksum and AHV numbers pass the EAN-13 checksum.

Authorized use only

This tool sends unsolicited form submissions to a remote host. Only run it against a phishing kit you own, operate, or are explicitly authorized to act against (for example an approved anti-phishing engagement). Running it against a system you do not control may be illegal.