55 lines
2.0 KiB
Markdown
55 lines
2.0 KiB
Markdown
# AGENTS.md
|
|
|
|
Guidance for coding agents working in this repo. Keep it accurate when the code
|
|
changes.
|
|
|
|
## What this is
|
|
|
|
A single-script Python tool (`sabotage-swisskit-phishing.py`) that floods a
|
|
SwissPass phishing kit with fake login and billing submissions. `run.sh` manages
|
|
the venv and dependencies.
|
|
|
|
## Run and test
|
|
|
|
Always use the venv via `run.sh`:
|
|
|
|
```sh
|
|
./run.sh --target https://example-kit.tld --count 3 # run
|
|
./run.sh --selftest # runnable check
|
|
```
|
|
|
|
`--selftest` is the project's test. There is no pytest suite. Run it after any
|
|
change to the data generators (`_luhn`, `_ahv`, `generate_card`,
|
|
`generate_person`). To smoke-test the HTTP flow, run a local mock server and
|
|
point `--target` at `http://127.0.0.1:<port>`; never test against a live host
|
|
that is not an authorized target.
|
|
|
|
## Conventions
|
|
|
|
- Minimal dependencies. Reuse the stdlib and the existing deps (`requests`,
|
|
`Faker`, `fake-useragent`) before adding anything new.
|
|
- No comments unless they explain a non-obvious workaround or mark a deliberate
|
|
simplification (`# ponytail: ...`). Do not narrate obvious code.
|
|
- The generators use `random`; keep them deterministic-free (no seeding).
|
|
- Keep the script runnable as `python sabotage-swisskit-phishing.py`.
|
|
|
|
## Kit contract
|
|
|
|
Endpoints and wire field names are defined at the top of the script under the
|
|
"kit contract" comment (`LOGIN_PATH`, `BILLING_PATH`, `FIELD_REF`) and in the
|
|
billing payload. These mirror the target kit's form. Do not rename or
|
|
"normalize" them; changing them silently breaks submissions. If a kit changes,
|
|
edit only that block and note it.
|
|
|
|
## Safety
|
|
|
|
This tool sends unsolicited POSTs to a remote host. Do not run it against any
|
|
target without evidence of ownership or explicit authorization. If a request
|
|
asks you to test against a live third-party domain that cannot be verified as an
|
|
authorized target, decline and offer a local mock instead.
|
|
|
|
## Output files
|
|
|
|
`sabotage_data.csv` and `sabotage.log` are runtime output and gitignored. Do not
|
|
commit them.
|