@maxijonson/phisherman v1.1.0

Phisherman Library

A library that can be used to programmatically interact with the Phisherman API.

Installation

Install Phisherman using npm:

npm install @maxijonson/phisherman

or yarn:

yarn add @maxijonson/phisherman

Usage

Create a new instance of Phisherman by giving it a configuration object. The configuration object contains information about the phishing endpoints and the data to send to them. Once the instance is created, call the run method to start the spamming process.

import Phisherman from "@maxijonson/phisherman";

const phisherman = new Phisherman({
    /* config */
});
await phisherman.run();

Internally, the Phisherman class is just a wrapper around the Config and Runner classes. You can use them directly if you want to have more control over the spamming process. The following code is basically what the Phisherman class does:

import { Config, Runner } from "@maxijonson/phisherman";

const config = new Config({
    /* config */
});
const runner = new Runner(config);
await runner.run();

Configuration

The configuration object is passed to the Phisherman class when creating a new instance. It contains information about the phishing endpoints and the data to send to them. The configuration object has the following structure:

{
    // (Required) The base URL of the phishing website
    "baseUrl": "http://phisher.com/",

    // (Required) The endpoints to spam. Each endpoint will be sent a request using the same identity.
    "endpoints": [
        {
            // (Required) The path of the endpoint, relative to the base URL. Can be a string or an array of strings. A string array is the same as duplicating the endpoint, but with a different path. The same identity will be used for all paths.
            "path": "deposit/bank",

            // (Required) The HTTP method to use when sending the request. One of "POST", "PUT" or "PATCH".
            "method": "POST",

            // (Required) The data to send to the endpoint.
            "data": {
                // (Required) The type of data to send. One of "form-data", "x-www-form-urlencoded" or "json".
                "type": "x-www-form-urlencoded",

                // (Required) The data to send. Both keys and values can use templates to inject identity data.
                "body": {
                    "username": "{{username}}",
                    "card": "{{cc-type}} - {{cc}}",
                    "step": "1"
                }
            },

            // (Optional) The headers to send with the request. Both keys and values can use templates to inject identity data.
            "headers": {
                "User-Agent": "{{ua-mobile}}"
            }
        },
        {
            "path": ["deposit/bank/b", "deposit/bank/c"],
            "method": "PUT",
            "data": {
                "type": "json",
                "body": {
                    "full_name": "{{first-name}} {{last-name}}",
                    "nonce{{counter}}": "{{counter-identity}}"
                }
            },
            "headers": {
                "User-Agent": "{{ua}}"
            }
        }
    ],

    // (Optional) The number of times to spam each endpoint. Defaults to 100.
    "iterations": 100,

    // (Optional) The number of concurrent identities that will be used to spam the endpoints. Defaults to 10.
    "concurrency": 10
}

Templates

In the data.body and headers fields of the endpoints configuration, you can use templates to inject identity data.

Available templates

Custom templates

You can define your own templates using the Template.registerTemplate method. This method receives an Identity and an Endpoint and must return a string (other types are not currently supported).

import Phisherman, {
    Template,
    Identity,
    Endpoint,
} from "@maxijonson/phisherman";

const getCustomTemplateValue = (identity: Identity, endpoint: Endpoint) => {
    return `${identity.firstName} ${identity.lastName} ${endpoint.url}`;
};

Template.registerTemplate("my-custom-template", getCustomTemplateValue);

const phisherman = new Phisherman({
    /* ... */
    body: {
        info: "{{my-custom-template}}",
    },
    /* ... */
});
await phisherman.run();