Update square-enix-ffxiv-gil-scam.yml #81
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bradleyjkemp
reviewed
Sep 1, 2022
Comment on lines
22
to
26
| - '.php" method="post"' | ||
| - '.php"' | ||
| - 'Square Enix ID' | ||
| - 'Square Enix Password' | ||
| - 'One-Time Password' | ||
| - 'name="key_value"' |
There was a problem hiding this comment.
This looks like it'll be too generic now? it'll flag on any PHP website containing those strings, not just this specific phishing kit?
There was a problem hiding this comment.
Updated the PR to make it more specific. It's unlikely a non-phishing login page would have all of those strings now.
All tests, positive and negative, in the first comment still pass.
bradleyjkemp
approved these changes
Sep 6, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Updated this in order to detect a variant of the same kit that wasn't previously captured:
31d11a34-8732-45c6-bb92-8d3df5263d02
Tested against all variants with matches for all:
f2508472-4dca-45da-ace4-02e80be5e1f7
e758276f-cf98-4b3d-947e-5aa6fe65bbac
654111fb-82ac-4973-880f-bbaec82694b9
67b4fe92-f667-4201-a310-2cd2cf72af8a
9b54f209-fafe-4c85-9a44-5c8969a4a4de
31d11a34-8732-45c6-bb92-8d3df5263d02
Tested against the real pages with no matches:
0970de9e-51c9-49f6-88e3-b40bf20dc747
503f6aad-34d7-4f18-ae71-908bfe32524b
e608e694-e245-494e-84cd-131db304ca69
2976bd04-42fd-4d24-a0cb-7cfb15abc333
27d57be6-364a-4c87-8228-814181eb7941
47388ae6-cc4b-4634-bec9-c0715bc02b8b
7e44ef66-c7de-4ffa-8034-5845039685e4
117f4d6d-0e7d-4da1-a1b1-aacb135997a7
9584edf0-5733-4f4c-afdf-3c3800efc6aa