Search for categorized domain
Python
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
CatMyPhish.py Update CatMyPhish.py Jun 13, 2018
LICENSE.md Update LICENSE.md Oct 13, 2017
README.md Update README.md Jun 13, 2018

README.md

CatMyPhish

Search for categorized domain that can be used during red teaming engagement. Perfect to setup whitelisted domain for your Cobalt Strike beacon C&C.

It relies on expireddomains.net to obtain a list of expired domains. The domain availability is validated using checkdomain.com

Usage

$ python CatMyFish.py -h
CatMyPhish v1.0 - Search for available already categorized domain
Mr.Un1k0d3r - RingZer0 Team 2016

usage: CatMyPhish.py [-h] [-v] [-e] [-f FILENAME] [-o OUTPUT]
                    [keywords [keywords ...]]

positional arguments:
  keywords              Keyword to use when search for expired domains

optional arguments:
  -h, --help            show this help message and exit
  -v, --verbose         More verbose output
  -e, --exitone         Stop querying Symantec after first success
  -f FILENAME, --filename FILENAME
                        Loads domains to check from a text file, instead of
                        searching
  -o OUTPUT, --output OUTPUT
                        Write unregistered, categorized domains to a file.

Example

$ python CatMyPhish.py sugar
CatMyPhish v1.0 - Search for available already categorized domain
Mr.Un1k0d3r - RingZer0 Team 2016

[+] (25) domains found using the keyword "sugar".
[+] Symantec categorization check may take several minutes. Bot check is pretty aggressive...
[+] Potential candidate: SugarNines.com categorized as Personal Sites.
[+] Potential candidate: CreativeSugarFlowers.com categorized as Restaurants/Dining/Food.
[+] Potential candidate: mysugargrove.com categorized as Society/Daily Living.
[+] Potential candidate: SugarTreeScrapbook.com categorized as Society/Daily Living.
[+] Potential candidate: SugarlandMania.com categorized as Entertainment.
[+] Potential candidate: SugarTreeProperties.com categorized as Real Estate.
[+] Potential candidate: BloodSugarTips.com categorized as Health.
[+] Potential candidate: SugarmillWoodsNews.com categorized as Real Estate.
[+] (8) candidates found.
[+] Awesome "SugarNines.com" is categorized and available.
[+] Awesome "CreativeSugarFlowers.com" is categorized and available.
[+] Awesome "mysugargrove.com" is categorized and available.
[+] Awesome "SugarTreeScrapbook.com" is categorized and available.
[+] Awesome "SugarlandMania.com" is categorized and available.
[+] Awesome "SugarTreeProperties.com" is categorized and available.
[+] Awesome "BloodSugarTips.com" is categorized and available.
[+] Awesome "SugarmillWoodsNews.com" is categorized and available.
[+] Search completed.

Warning

the Symantec categorization search is slow to avoid captcha. Using proxychains and Tor is a good workaround.

TODO

  • Categorization check against other vendors.
  • Populate the blacklisted categories

Credit

Mr.Un1k0d3r RingZer0 Team