<commit_before># PhishingKitHunter
*Find phishing kits which use your brand/organization's files and image.*

**PhishingKitHunter** (or *PKHunter*) is a tool made for identifying phishing kits URLs used in phishing campains targeting your customers and using some of your own website files (as CSS, JS, ...).
This tool - write in Python 3 - is based on the analysis of referer's URL which GET particular files on the legitimate website (as some style content) or redirect user after the phishing session. Log files (should) contains the referer URL where the user come from and where the phishing kit is deployed.
**PhishingKitHunter** parse your logs file to identify particular and non-legitimate referers trying to get legitimate pages based on regular expressions you put into PhishingKitHunter's config file.

## Features
- find URL where a phishing kit is deployed
- find if the phishing kit is still up and running
- generate a JSON report usefull for external usage
- use a hash of the phishing kit's page to identify the kit
- use a timestamp for history
- can use HTTP or SOCKS5 proxy

## Usage
~~~
$ ./PhishingKitHunter.py -i LogFile2017.log -o PKHunter-report-20170502-013307.json -c conf/test.conf

  _ \  |  / |   |             |            
 |   | ' /  |   | |   | __ \  __|  _ \  __|
 ___/  . \  ___ | |   | |   | |    __/ |   
_|    _|\_\_|  _|\__,_|_|  _|\__|\___|_|   

-= Phishing Kit Hunter - v0.7 =-

[+] http://badscam.org/includes/ap/?a=2
		|   Timestamp: 01/May/2017:13:00:03
		| HTTP status: can't connect (HTTP Error 404: Not Found)
[+] http://scamme.com/aple/985884e5b60732b1245fdfaf2a49cdfe/
		|   Timestamp: 01/May/2017:13:00:49
		| HTTP status: can't connect (<urlopen error [Errno -2] Name or service not known>)<commit_msg>PhishingKitHunter - v0.7 modifications<commit_after># PhishingKitHunter
*Find phishing kits which use your brand/organization's files and image.*

**PhishingKitHunter** (or *PKHunter*) is a tool made for identifying phishing kits URLs used in phishing campains targeting your customers and using some of your own website files (as CSS, JS, ...).
This tool - write in Python 3 - is based on the analysis of referer's URL which GET particular files on the legitimate website (as some style content) or redirect user after the phishing session. Log files (should) contains the referer URL where the user come from and where the phishing kit is deployed.
**PhishingKitHunter** parse your logs file to identify particular and non-legitimate referers trying to get legitimate pages based on regular expressions you put into PhishingKitHunter's config file.

## Features
- find URL where a phishing kit is deployed
- find if the phishing kit is still up and running
- generate a JSON report usefull for external usage
- use a hash of the phishing kit's page to identify the kit
- use a timestamp for history
- can use HTTP or SOCKS5 proxy
- WHOIS enrichment to console and JSON report

## Usage
~~~
$ ./PhishingKitHunter.py -i LogFile2017.log -o PKHunter-report-20170502-013307.json -c conf/test.conf

  _ \  |  / |   |             |            
 |   | ' /  |   | |   | __ \  __|  _ \  __|
 ___/  . \  ___ | |   | |   | |    __/ |   
_|    _|\_\_|  _|\__,_|_|  _|\__|\___|_|   

-= Phishing Kit Hunter - v0.7 =-

[+] http://badscam.org/includes/ap/?a=2
		|   Timestamp: 01/May/2017:13:00:03
		| HTTP status: can't connect (HTTP Error 404: Not Found)
[+] http://scamme.com/aple/985884e5b60732b1245fdfaf2a49cdfe/
		|   Timestamp: 01/May/2017:13:00:49
		| HTTP status: can't connect (<urlopen error [Errno -2] Name or service not known>)
{'fraction_non_alphanumeric': 0.09684621825286073, 'fraction_numerical': 0.03963159363661736, 'mean_word_length': 3.2514827995255042, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5460830', 'n_tokens_mistral': 1236, 'n_tokens_neox': 1098, 'n_words': 428}