2.0 KiB
AGENTS.md
Guidance for coding agents working in this repo. Keep it accurate when the code changes.
What this is
A single-script Python tool (sabotage-swisskit-phishing.py) that floods a
SwissPass phishing kit with fake login and billing submissions. run.sh manages
the venv and dependencies.
Run and test
Always use the venv via run.sh:
./run.sh --target https://example-kit.tld --count 3 # run
./run.sh --selftest # runnable check
--selftest is the project's test. There is no pytest suite. Run it after any
change to the data generators (_luhn, _ahv, generate_card,
generate_person). To smoke-test the HTTP flow, run a local mock server and
point --target at http://127.0.0.1:<port>; never test against a live host
that is not an authorized target.
Conventions
- Minimal dependencies. Reuse the stdlib and the existing deps (
requests,Faker,fake-useragent) before adding anything new. - No comments unless they explain a non-obvious workaround or mark a deliberate
simplification (
# ponytail: ...). Do not narrate obvious code. - The generators use
random; keep them deterministic-free (no seeding). - Keep the script runnable as
python sabotage-swisskit-phishing.py.
Kit contract
Endpoints and wire field names are defined at the top of the script under the
"kit contract" comment (LOGIN_PATH, BILLING_PATH, FIELD_REF) and in the
billing payload. These mirror the target kit's form. Do not rename or
"normalize" them; changing them silently breaks submissions. If a kit changes,
edit only that block and note it.
Safety
This tool sends unsolicited POSTs to a remote host. Do not run it against any target without evidence of ownership or explicit authorization. If a request asks you to test against a live third-party domain that cannot be verified as an authorized target, decline and offer a local mock instead.
Output files
sabotage_data.csv and sabotage.log are runtime output and gitignored. Do not
commit them.