forked from cwilkc/phloodthephish
-
Notifications
You must be signed in to change notification settings - Fork 0
/
phloodphish.py
executable file
·75 lines (57 loc) · 2.83 KB
/
phloodphish.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
# Inspired by the Engineer Man on Youtube. Code modified from his original video on how to create a quick python script to
# send garbage data to scammer
# His link: https://www.youtube.com/channel/UCrUL8K81R4VBzm-KOYwrcxQ
# The video in question: https://www.youtube.com/watch?v=UtNYzv8gLbs
# Password and Name dictionaries sourced from https://github.com/danielmiessler/SecLists
import requests
import os
import random
import string
import json
import time
chars1 = string.ascii_letters + string.digits + '!@#$%^&*()'
random.seed = (os.urandom(1024))
# Open names, words, and domains dictionaries
names = json.loads(open('names.json').read())
words = json.loads(open('words.json').read())
domains = json.loads(open('domains.json').read())
surnames = json.loads(open('surnames.json').read())
pswds = json.loads(open('passwords.json').read())
while True:
# Sleep random number of seconds as to not DDOS the site and make it harder for them to ignore blocks of flooded fake
# based on time stamps.
time.sleep(random.randint(60, 600))
# Grab a random domain from the domains.json list
domain = random.choice(domains)
# USER NAME CREATION
if random.getrandbits(1):
name = random.choice(names)
if random.randint(1, 10) == 1:
name += '.' + random.choice(surnames)
else:
name_words = random.sample(words, 2)
name = "".join(name_words)
# Create a random number to add to the end of usernames
name_extra = ''.join(random.choice(string.digits) for i in range(random.randint(1, 4)))
# Create the username from the dictionary, extra digits and a domain.
username = name.lower() + name_extra + "@" + domain
# PASSWORD CREATION
if random.getrandbits(1):
# Create a random 8 character password with letters defined in chars1 variable
password = ''.join(random.choice(chars1) for i in range(random.randint(8, 12)))
elif random.getrandbits(1):
pass_words = random.sample(words, 2)
pass_extra = ''.join(random.choice(string.digits) for i in range(random.randint(0, 2)))
password = "".join(pass_words) + pass_extra
else:
password = random.choice(pswds)
# The following commented lines of code are what will be needed from running DevTools in chrome and seeing the format
# of the form data being sent to the scamming site. Feel ree to add more variables if there is a hash token that needs to be
# passed as well but the majorite seem to have some variation of #username and #password. Replace the hashed names with the
# correct variables called by the form and set the URL to the URL shown in the forn data.
# url =
# requests.post(url, allow_redirects=False, data={
# '#username': username,
# '#password': password
# })
print "sending username %s and password %s" % (username, password)