Monday, February 3, 2020

phishing log hunting

import requests
import os
filepath = 'urls.txt'
folders = ["", "log", "logs", "script", "scripts"]
files = ["logs.txt", "log.txt", "log.html", "logs.html", "error_logs.txt", "error_log.txt", "script.txt", "1.php", "ise.txt", "user.txt", "users.txt", "stored.txt", "fullz.txt", "accounts.txt", "login.txt", "logins.txt", "U1.txt"]
printfailures = 0
foundcount = 0
quietmode = 1
printstatus = 1
searchcount = 0
with open(filepath) as fp:
 theurl = fp.readline()
 while theurl:
  searchcount = searchcount + 1
  theurl = theurl.strip()
  lastparen = theurl.rfind("/")
  baseurl = ""
  if lastparen > 10:
   baseurl = theurl[:lastparen]
  else:
   baseurl = theurl
  if printstatus == 1:
   if searchcount % 10 == 0:
    print("----------")
    print("STATUS   : %s done" % searchcount)
    print("----------")
  if quietmode == 0:
   print("----------")
   print("TESTING  : %s" % baseurl)
   print("----------")
  timeout = 0
  foundcount = 0
  for folder in folders:
   if timeout == 1:
    break
   if foundcount > 2:
    break
   for file in files:
    if timeout == 1:
     if quietmode == 0:
      print("**TIMEOUT DETECTED, CANCELLING")
     break
    if foundcount > 2:
     print("**HIGH HIT RATE DETECTED, STOPPING SEARCH, LIKELY FALSE POSITIVE")
     break
    stem = ("/%s/%s" % (folder, file))
    stem = stem.replace("//", "/")
    url = ("%s%s" % (baseurl, stem))
    try:
     response = requests.get(url, timeout=2)
     if response.status_code == 200:
      foundcount = foundcount + 1
      if quietmode == 1:
       if foundcount == 1:
        print("----------")
        print("URL      : %s" % baseurl)
        print("----------")
      print("=>FOUND<=: %s (RESPONSE: %s)" % ( stem , str(response.status_code) ))
     else:
      if printfailures == 1:
       if quietmode == 0:
        print("**FAIL   : %s (RESPONSE: %s)" % ( stem , str(response.status_code) ))
    except:
     timeout = 1
     if printfailures == 1:
      if quietmode == 0:
       print("**FAIL   : %s (TIMEOUT)" % theurl)
  if foundcount == 0:
   if quietmode == 0:
    print("**0 HITS")
  theurl = fp.readline()

4 comments:

  1. Hey, do you think it is possible to parse these logs to send a notification to the victims to let them know what info has been phished?

    ReplyDelete
  2. I want to thank Dr Emu a very powerful spell caster who help me to bring my husband back to me, few month ago i have a serious problem with my husband, to the extend that he left the house, and he started dating another woman and he stayed with the woman, i tried all i can to bring him back, but all my effort was useless until the day my friend came to my house and i told her every thing that had happened between me and my husband, then she told me of a powerful spell caster who help her when she was in the same problem I then contact Dr Emu and told him every thing and he told me not to worry my self again that my husband will come back to me after he has cast a spell on him, i thought it was a joke, after he had finish casting the spell, he told me that he had just finish casting the spell, to my greatest surprise within 48 hours, my husband really came back begging me to forgive him, if you need his help you can contact him with via email: Emutemple@gmail.com or add him up on his whatsapp +2347012841542 is willing to help any body that need his help. 

    ReplyDelete
  3. Hello everyone.

    I'm Selling SSN Fullz/Pros/profile fresh leads.

    (Details in leads are):

    °First & last Name
    °SSN
    °DRIVING LICENSE NUMBER(DL)
    °DOB
    °Phone Numbers
    °Email Address
    °City
    °State
    °Zip
    °Residential Status
    °Account
    °Relative Details
    °Employment status
    °Previous Address
    °Income Details
    °Husband/Wife info
    °Mortgage Info
    Etc

    All leads are genuine, fresh & Fetching by SPAMMING

    Dealing in almost all types of leads.

    *Let's come for a long term Business

    *Payment Method
    (BTC&Paypal)

    *Contact Me*:

    Mail: Leadsprovider756@gmail.com
    Telegram: @LeadsproviderUSA

    ReplyDelete
  4. Hello everyone.
    I'm Selling SSN Fullz/Pros/profile fresh leads.

    (Details in leads are):
    °First & last Name
    °SSN
    °DRIVING LICENSE NUMBER(DL)
    °DOB
    °Phone Numbers
    °Email Address
    °City
    °State
    °Zip
    °Residential
    °Status
    °Account
    °Relative Details
    °Employment status
    °Previous Address
    °Income Details
    °Husband/Wife info
    °Mortgage Info
    Etc

    All leads are genuine, fresh & generated by SPAMMING
    Dealing in almost all types of leads.

    *Let's come for a long term Business

    *Payment Method
    (BTC&Paypal)

    *Contact Me*:
    Mail: Leadsprovider756@gmail.com
    Telegram: @LeadsproviderUSA

    ReplyDelete