trape (open source)
People tracker on the Internet: Learn to track the world, to avoid being traced.
Trape is an OSINT analysis and research tool, which allows people to track and execute intelligent social engineering attacks in real time. It was created with the aim of teaching the world how large Internet companies could obtain confidential information such as the status of sessions of their websites or services and control over their users through the browser, without them knowing, but It evolves with the aim of helping government organizations, companies and researchers to track the cybercriminals.
- LOCATOR OPTIMIZATION: Trace the path between you and the target you’re tracking. Each time you make a move, the path will be updated, by means of this the location of the target is obtained silently through a bypass made in the browsers, allowing you not to skip the location request permit on the victim’s side , objective or person and at the same time maintain a precision of 99% in the locator.
- REST API: Generates an API (random or custom), and through this you can control and monitor other Web sites on the Internet remotely, getting the traffic of all visitors.
- PROCESS HOOKS: Manages social engineering attacks or processes in the target’s browser.
— SEVERAL: You can issue a phishing attack of any domain or service in real time as well as send malicious files to compromise the device of a target.
— SPEECH: A process of audio creation is maintained which is played in the browser of the objective, by means of this you can execute personalized messages in different voices with languages in Spanish and English.
- PUBLIC NETWORK TUNNEL: Trape has its own API that is linked to ngrok.com to allow the automatic management of public network tunnels; By this you can publish your content of trape server executed locally to the Internet, to manage hooks or public attacks.
- CLICK ATTACK TO GET CREDENTIALS: Automatically obtains the target credentials, recognizing your connection availability on a social network or Internet service.
- NETWORK: You can get information about the user’s network.
— SPEED: Viewing the target’s network speed. (Ping, download, upload, type connection)
— HOSTS OR DEVICES: Here you can get a scan of all the devices that are connected in the target network automatically.
PROFILE: Brief summary of the target’s behavior and important additional information about your device.
— GPU — ENERGY
Session recognition is one of trape most interesting attractions, since you as a researcher can know remotely what service the target is connected to.
- USABILITY: You can delete logs and view alerts for each process or action you run against each target.
How to use it
First, unload the tool.
git clone https://github.com/jofpin/trape.git
python trape.py -h
If it does not work, try to install all the libraries that are located in the file requirements.txt
pip install -r requirements.txt
Example of execution
python trape.py –url http://example.com –port 8080
–url In this option you add the URL you use to clone Live, which works as a decoy.
–port Here you insert the port, where you are going to run the trape server.
–accesskey You enter a custom key for the trape panel, if you do not insert it will generate an automatic key.
–injectcode trape contains a REST API to play anywhere, using this option you can customize the name of the file to include, if it does not, generates a random name allusive to a token.
–local Using this option you can call a local HTML file, this is the replacement of the –url option made to run a local lure in trape.
–ngrok In this option you can enter a token, to run at the time of a process. This would replace the token saved in configurations.
–version You can see the version number of trape.
–help It is used to see all the above options, from the executable.
At an international security event in Colombia, called DragonJAR Security Conference 2017, a demonstration was made before the launch. You can watch the video here.
This tool has been published educational purposes in order to teach people how bad guys could track them or monitor them or obtain information from their credentials, we are not responsible for the use or the scope that may have the People through this project.
We are totally convinced that if we teach how vulnerable things are, we can make the Internet a safer place.
Copyright, 2018 by Jose Pino