mirror of
https://github.com/byt3bl33d3r/MITMf.git
synced 2025-07-16 10:03:52 -07:00
57 lines
No EOL
2.1 KiB
INI
57 lines
No EOL
2.1 KiB
INI
[DEFAULT]
|
|
; HTML5 AppCache poisioning attack
|
|
; see http://blog.kotowicz.net/2010/12/squid-imposter-phishing-websites.html for description of the attack.
|
|
; generic settings for tampering engine
|
|
|
|
enabled=True
|
|
tamper_class=app_cache_poison.AppCachePoison
|
|
;all settings below are specific for AppCachePoison
|
|
|
|
templates_path=app_cache_poison/templates
|
|
;enable_only_in_useragents=Chrome|Firefox
|
|
|
|
; when visiting first url matching following expression we will embed iframes with all tamper URLs
|
|
;(to poison the cache for all of them all at once)
|
|
mass_poison_url_match=http://.*prezydent\.pl.*
|
|
; it's only useful to mass poison chrome because:
|
|
; - it supports iframe sandbox preventing framebusting
|
|
; - does not ask for confirmation
|
|
mass_poison_useragent_match=Chrome|Safari
|
|
|
|
[test]
|
|
; any //example.com URL redirects to iana and will display our spoofed content
|
|
tamper_url=http://example.com/
|
|
manifest_url=http://www.iana.org/robots.txt ;use existing static URL that is rarely seen by the browser user, but exists on the server (no 404!)
|
|
templates=test ; which templates to use for spoofing content?
|
|
skip_in_mass_poison=1
|
|
|
|
; use absolute URLs - system tracks 30x redirects, so you can put any URL that belongs to the redirection loop here
|
|
[gmail]
|
|
tamper_url=http://mail.google.com/mail/
|
|
; manifest has to be of last domain in redirect loop
|
|
manifest_url=http://mail.google.com/robots.txt
|
|
templates=default ; could be omitted
|
|
|
|
[facebook]
|
|
tamper_url=http://www.facebook.com/
|
|
manifest_url=http://www.facebook.com/robots.txt
|
|
templates=facebook ; use different template
|
|
|
|
[twitter]
|
|
tamper_url=http://twitter.com/
|
|
;tamper_url_match=^http://(www\.)?twitter\.com/$
|
|
manifest_url=http://twitter.com/robots.txt
|
|
|
|
[testing]
|
|
tamper_url=http://www.html5rocks.com/en/
|
|
manifest_url=http://www.html5rocks.com/robots.txt
|
|
|
|
; we can also modify non-HTML URLs to append malicious code to them
|
|
; but for them to be cached in HTML5 AppCache they need to be referred in
|
|
; manifest for a poisoned domain
|
|
; if not, they are "only" cached for 10 years :D
|
|
[ga]
|
|
raw_url=http://www.google-analytics.com/ga.js
|
|
templates=script
|
|
skip_in_mass_poison=1
|
|
;you can add other scripts in additional sections like jQuery etc. |