StalkPhish
StalkPhish is a tool created for searching into free OSINT databases for specific phishing kits URL. More, StalkPhish is designed to try finding phishing kits sources. Some scammers can’t or don’t remove their phishing kit sources when they deploy it. You can try to find these sources to extract some useful information as e-mail addresses where is send stolen data, some more information about scammer or phishing kit developer. From there you can extend your knowledge about the threat and organizations, and get much useful information for your investigations.
find URL where a phishing kit is deployed (from OSINT databases)
find if the phishing kit is still up and running
generate hash of page
try to download phishing kit sources (trying to find .zip file)
use a hash of the phishing kit archive to identify the kit and threat
extract e-mails found in phishing kit
use timestamps for history
can use HTTP or SOCKS5 proxy (for downloads)
add just one url at a time into the database
store AS number in the database
Changelog v0.9.8-3
urlscan.io API key management
Install
git clone https://github.com/t4d/StalkPhish.git
Configuration file
Some configurable parameters are:
search: External source keywords to search for
log_file: The logging file (the path and file will be created if don’t exist)
Kits_download_Dir: Directory to store downloaded phishing kits archives
sqliteDB_tablename: Main database table
sqliteDB_Investig_tablename: Investigation table with useful information for investigations
http_proxy: HTTP/Socks5 proxy to use for downloads
UAfile: HTTP user-agents file to use for phishing kits HTTP Get information
Basic usage
$ ./StalkPhish.py -c conf/example.conf
Advanced usage (find phishing kits sources)
$ ./StalkPhish.py -c conf/example.conf -G -N
Demo
VIDEO
Copyright (C) t4d
Source: https://github.com/t4d/
