Skip to content

Commit

Permalink
Fix mapping phishing (#2576)
Browse files Browse the repository at this point in the history
* Fixed text input mapping generation

* Removed parameter from post as not required
  • Loading branch information
fgibertoni authored Nov 21, 2024
1 parent 22c07c5 commit 676c1a4
Showing 1 changed file with 35 additions and 26 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,6 @@
from api_app.models import PythonConfig

logger = logging.getLogger(__name__)
fake = Faker()


def xpath_query_on_page(page, xpath_selector: str) -> []:
Expand All @@ -33,30 +32,6 @@ class PhishingFormCompiler(FileAnalyzer):
cvv_matching: list = []
expiration_date_matching: list = []

# mapping between name attribute of text <input>
# and their corresponding fake values
_name_text_input_mapping: {tuple: str} = {
tuple(name_matching): fake.user_name(),
tuple(cc_matching): fake.credit_card_number(),
tuple(pin_matching): str(fake.random.randint(10000, 100000)),
tuple(cvv_matching): fake.credit_card_security_code(),
tuple(expiration_date_matching): fake.credit_card_expire(
start=date.today(),
end=date.today() + timedelta(days=fake.random.randint(1, 1000)),
date_format="%m/%y",
),
}

FAKE_EMAIL_INPUT: str = fake.email()
FAKE_PASSWORD_INPUT: str = fake.password(
length=16,
special_chars=True,
digits=True,
upper_case=True,
lower_case=True,
)
FAKE_TEL_INPUT: str = fake.phone_number()

def __init__(
self,
config: PythonConfig,
Expand All @@ -67,6 +42,10 @@ def __init__(
self.html_source_code: str = ""
self.parsed_page = None
self.args: [] = []
self._name_text_input_mapping: {} = None
self.FAKE_EMAIL_INPUT = None
self.FAKE_PASSWORD_INPUT = None
self.FAKE_TEL_INPUT = None

def config(self, runtime_configuration: Dict):
super().config(runtime_configuration)
Expand All @@ -86,6 +65,37 @@ def config(self, runtime_configuration: Dict):
f"Job #{self.job_id}: Target site from parent job not found! Proceeding with only source code."
)

# generate fake values for each mapping
fake = Faker()
# mapping between name attribute of text <input>
# and their corresponding fake values
self._name_text_input_mapping: {tuple: str} = {
tuple(self.name_matching): fake.user_name(),
tuple(self.cc_matching): fake.credit_card_number(),
tuple(self.pin_matching): str(fake.random.randint(10000, 100000)),
tuple(self.cvv_matching): fake.credit_card_security_code(),
tuple(self.expiration_date_matching): fake.credit_card_expire(
start=date.today(),
end=date.today() + timedelta(days=fake.random.randint(1, 1000)),
date_format="%m/%y",
),
}
logger.info(
f"Generated name text input mapping {self._name_text_input_mapping}"
)
self.FAKE_EMAIL_INPUT: str = fake.email()
logger.info(f"Generated fake email input {self.FAKE_EMAIL_INPUT}")
self.FAKE_PASSWORD_INPUT: str = fake.password(
length=16,
special_chars=True,
digits=True,
upper_case=True,
lower_case=True,
)
logger.info(f"Generated fake password input {self.FAKE_PASSWORD_INPUT}")
self.FAKE_TEL_INPUT: str = fake.phone_number()
logger.info(f"Generated fake tel input {self.FAKE_TEL_INPUT}")

# extract and decode source code from file
self.html_source_code = self.read_file_bytes()
if self.html_source_code:
Expand Down Expand Up @@ -166,7 +176,6 @@ def perform_request_to_form(self, form) -> Response:
logger.info(f"Job #{self.job_id}: Sending {params=} to submit url {dest_url}")
return requests.post(
url=dest_url,
params=params,
data=params,
proxies=(
{"http": self.proxy_address, "https": self.proxy_address}
Expand Down

0 comments on commit 676c1a4

Please sign in to comment.