Skip to content

Mr-Un1k0d3r/CatMyPhish

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

50 Commits
 
 
 
 
 
 

Repository files navigation

This tool is outdated

CatMyPhish

Search for categorized domain that can be used during red teaming engagement. Perfect to setup whitelisted domain for your Cobalt Strike beacon C&C.

It relies on expireddomains.net to obtain a list of expired domains. The domain availability is validated using checkdomain.com

Usage

$ python CatMyFish.py -h
CatMyPhish v1.0 - Search for available already categorized domain
Mr.Un1k0d3r - RingZer0 Team 2016

usage: CatMyPhish.py [-h] [-v] [-e] [-f FILENAME] [-o OUTPUT]
                    [keywords [keywords ...]]

positional arguments:
  keywords              Keyword to use when search for expired domains

optional arguments:
  -h, --help            show this help message and exit
  -v, --verbose         More verbose output
  -e, --exitone         Stop querying Symantec after first success
  -f FILENAME, --filename FILENAME
                        Loads domains to check from a text file, instead of
                        searching
  -o OUTPUT, --output OUTPUT
                        Write unregistered, categorized domains to a file.

Example

$ python CatMyPhish.py sugar
CatMyPhish v1.0 - Search for available already categorized domain
Mr.Un1k0d3r - RingZer0 Team 2016

[+] (25) domains found using the keyword "sugar".
[+] Symantec categorization check may take several minutes. Bot check is pretty aggressive...
[+] Potential candidate: SugarNines.com categorized as Personal Sites.
[+] Potential candidate: CreativeSugarFlowers.com categorized as Restaurants/Dining/Food.
[+] Potential candidate: mysugargrove.com categorized as Society/Daily Living.
[+] Potential candidate: SugarTreeScrapbook.com categorized as Society/Daily Living.
[+] Potential candidate: SugarlandMania.com categorized as Entertainment.
[+] Potential candidate: SugarTreeProperties.com categorized as Real Estate.
[+] Potential candidate: BloodSugarTips.com categorized as Health.
[+] Potential candidate: SugarmillWoodsNews.com categorized as Real Estate.
[+] (8) candidates found.
[+] Awesome "SugarNines.com" is categorized and available.
[+] Awesome "CreativeSugarFlowers.com" is categorized and available.
[+] Awesome "mysugargrove.com" is categorized and available.
[+] Awesome "SugarTreeScrapbook.com" is categorized and available.
[+] Awesome "SugarlandMania.com" is categorized and available.
[+] Awesome "SugarTreeProperties.com" is categorized and available.
[+] Awesome "BloodSugarTips.com" is categorized and available.
[+] Awesome "SugarmillWoodsNews.com" is categorized and available.
[+] Search completed.

Warning

the Symantec categorization search is slow to avoid captcha. Using proxychains and Tor is a good workaround.

TODO

  • Categorization check against other vendors.
  • Populate the blacklisted categories

Credit

Mr.Un1k0d3r RingZer0 Team

About

Search for categorized domain

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages