gfyp icon indicating copy to clipboard operation
gfyp copied to clipboard

feat: Poke at found domain variant with web requests

Open kristovatlas opened this issue 8 years ago • 3 comments

Most domain variants in my experience are boring squatted domains, and could be easily differentiated with a simple HTTP request to http://example.com/.

This could be further extended to support customization by the user to look for the presence or absence of certain tell-tale strings in webpages and for other URL patterns, e.g. to detect commonly known phishing kit installations.

kristovatlas avatar Jan 19 '17 23:01 kristovatlas

Another reason why this would be a useful feature based on my recent observations, @0xd34db33f: Phishing sites sometimes start out appearing as squatted domains and later change into phishing sites later on without changing DNS settings. It would be cool if this tool could optionally monitor sites over time and alert to changes aside from purely DNS-based ones.

kristovatlas avatar Mar 02 '17 17:03 kristovatlas

Love the idea, should be pretty trivial using requests library, md5'ing the downloaded information, and then checking if it's different than the value in a new table we setup. Only tricky part is I've seen a few typo-squatters at $dayjob where they are filled with dynamic content. Wonder if we tweak it so util.py can have an option to disable it if the domain is problematic?

0xd34db33f avatar May 24 '17 01:05 0xd34db33f

Started coding this up using Scrapy a little bit ago. Think I've got something, so I'll take ownership for now.

0xd34db33f avatar Mar 04 '18 14:03 0xd34db33f