Skip to content
This repository was archived by the owner on Sep 2, 2019. It is now read-only.

Commit febf447

Browse files
author
ecstatic_nobel
committed
Update README.md
1 parent 299df0a commit febf447

File tree

1 file changed

+32
-32
lines changed

1 file changed

+32
-32
lines changed

‎README.md‎

Lines changed: 32 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,17 @@
22
##### Be the first to know on a need-to-know basis.
33

44
### Description
5-
With `aa_adhoc`, run through a list of URLs and recursively check sites for malicious files based on predefined file extensions.
5+
With `aa_adhoc`, run through a list of URLs and check sites for malicious files based on predefined file extensions.
66

77
With `aa_certstream`, find out when a phishing kit has been staged on a domain. With this information, you can be amongst the first to:
88
- Know
99
- Block
1010
- Report
1111
- Analyze
1212

13-
With `aa_urlscan`, easily search [urlscan.io](https://urlscan.io/) and recursively check sites for malicious files based on predefined file extensions.
13+
With `aa_urlscan`, easily search [urlscan.io](https://urlscan.io/) and check sites for malicious files based on predefined file extensions.
1414

15-
With `aa_whoisds`, download a list of newly registered domains from [WHOIS Domain Search](https://whoisds.com/newly-registered-domains), score the domains, and search for signs of phishing activity.
15+
With `aa_whoisds`, download a list of newly registered domains from [WHOIS Domain Search](https://whoisds.com/newly-registered-domains), score the domains, and search for signs of malicious activity.
1616

1717
### Prerequisites
1818
- Ubuntu 18.04+ (should work on other Linux distros)
@@ -32,24 +32,22 @@ With `aa_whoisds`, download a list of newly registered domains from [WHOIS Domai
3232
**aa_adhoc**
3333
The following command will:
3434
- Make requests to the domains retrieved from a file
35-
- Recursively download the site when an open directory hosting a file with the desired file extension
35+
- Download files from the site when an open directory is found hosting a file with the desired file extension
3636

37-
3 positional arguments needed:
37+
1 positional arguments needed:
3838
- **Input File** : Path to the file containing URLs
39-
- **File Extension** : 7z, apk, bat, bz, bz2, crypt, dll, doc, docx, exe, gz, hta, iso, jar, json, lnk, ppt, ps1, py, rar, sfx, sh, tar, vb, vbs, xld, xls, xlsx, zip
4039

4140
Optional arguments:
42-
- **--file-dir** : Directory to use for interesting files detected (default: ./InterestingFiles/)
43-
- **--kit-dir** : Directory to use for phishing kits detected (default: ./KitJackinSeason/)
44-
- **--level** : Recursion depth (default=1, infinite=0)
45-
- **--quiet** : Don't show wget output
46-
- **--threads** : Numbers of threads to spawn
47-
- **--timeout** : Set time to wait for a connection
48-
- **--tor** : Download files via the Tor network
49-
- **--very-verbose** : Show error messages
41+
- **--directory** : Download data to CAP_DIR (default: ./Captures)
42+
- **--level** : Recursion depth (default=1, infinite=0)
43+
- **--quiet** : Don't show wget output
44+
- **--threads** : Numbers of threads to spawn
45+
- **--timeout** : Set the connection timeout to TIMEOUT
46+
- **--tor** : Download files via the Tor network
47+
- **--very-verbose** : Show error messages
5048
5149
```bash
52-
python aa_adhoc.py <INPUT_FILE> <FILE_EXTENSION> [--file-dir] [--kit-dir] [--level] [--quiet] [--threads] [--timeout] [--tor] [--very-verbose]
50+
python aa_adhoc.py <INPUT_FILE> [--directory] [--level] [--quiet] [--threads] [--timeout] [--tor] [--very-verbose]
5351
```
5452
5553
**aa_certstream**
@@ -61,20 +59,19 @@ The following command will:
6159
6260
Optional arguments:
6361
- **--dns-twist** : Check the twisted keywords found in dns_twisted.yaml
64-
- **--file-dir** : Directory to use for interesting files detected (default: ./InterestingFiles/)
65-
- **--kit-dir** : Directory to use for phishing kits detected (default: ./KitJackinSeason/)
62+
- **--directory** : Download data to CAP_DIR (default: ./Captures)
6663
- **--level** : Recursion depth (default=1, infinite=0)
6764
- **--log-nc** : File to store domains that have not been checked
6865
- **--quiet** : Don't show wget output
6966
- **--score** : Minimum score to trigger a session (Default: 75)
7067
- **--threads** : Numbers of threads to spawn
71-
- **--timeout** : Set time to wait for a connection
68+
- **--timeout** : Set the connection timeout to TIMEOUT
7269
- **--tor** : Download files via the Tor network
7370
- **--verbose** : Show domains being scored
7471
- **--very-verbose** : Show error messages
7572

7673
```bash
77-
python aa_certstream.py [--dns-twist] [--file-dir] [--kit-dir] [--level] [--log-nc] [--quiet] [--score] [--threads] [--timeout] [--tor] [--verbose] [--very-verbose]
74+
python aa_certstream.py [--dns-twist] [--directory] [--level] [--log-nc] [--quiet] [--score] [--threads] [--timeout] [--tor] [--verbose] [--very-verbose]
7875
```
7976

8077
**aa_urlscan**
@@ -88,17 +85,16 @@ The following command will:
8885
- **File Extension** : 7z, apk, bat, bz, bz2, crypt, dll, doc, docx, exe, gz, hta, iso, jar, json, lnk, ppt, ps1, py, rar, sfx, sh, tar, vb, vbs, xld, xls, xlsx, zip
8986

9087
Optional arguments:
91-
- **--file-dir** : Directory to use for interesting files detected (default: ./InterestingFiles/)
92-
- **--kit-dir** : Directory to use for phishing kits detected (default: ./KitJackinSeason/)
93-
- **--level** : Recursion depth (default=1, infinite=0)
94-
- **--quiet** : Don't show wget output
95-
- **--threads** : Numbers of threads to spawn
96-
- **--timeout** : Set time to wait for a connection
97-
- **--tor** : Download files via the Tor network
98-
- **--very-verbose** : Show error messages
88+
- **--directory** : Download data to CAP_DIR (default: ./Captures)
89+
- **--level** : Recursion depth (default=1, infinite=0)
90+
- **--quiet** : Don't show wget output
91+
- **--threads** : Numbers of threads to spawn
92+
- **--timeout** : Set the connection timeout to TIMEOUT
93+
- **--tor** : Download files via the Tor network
94+
- **--very-verbose** : Show error messages
9995
10096
```bash
101-
python aa_urlscan.py <QUERY_TYPE> <DELTA> <FILE_EXTENSION> [--file-dir] [--kit-dir] [--level] [--quiet] [--threads] [--timeout] [--tor] [--very-verbose]
97+
python aa_urlscan.py <QUERY_TYPE> <DELTA> <FILE_EXTENSION> [[--directory] [--level] [--quiet] [--threads] [--timeout] [--tor] [--very-verbose]
10298
```
10399
**Note**: If the path is a file, it will be automatically downloaded.
104100
@@ -113,20 +109,19 @@ python aa_urlscan.py <QUERY_TYPE> <DELTA> <FILE_EXTENSION> [--file-dir] [--kit-d
113109
114110
Optional arguments:
115111
- **--dns-twist** : Check the twisted keywords found in dns_twisted.yaml
116-
- **--file-dir** : Directory to use for interesting files detected (default: ./InterestingFiles/)
117-
- **--kit-dir** : Directory to use for phishing kits detected (default: ./KitJackinSeason/)
112+
- **--directory** : Download data to CAP_DIR (default: ./Captures)
118113
- **--level** : Recursion depth (default=1, infinite=0)
119114
- **--log-nc** : File to store domains that have not been checked
120115
- **--quiet** : Don't show wget output
121116
- **--score** : Minimum score to trigger a session (Default: 75)
122117
- **--threads** : Numbers of threads to spawn
123-
- **--timeout** : Set time to wait for a connection
118+
- **--timeout** : Set the connection timeout to TIMEOUT
124119
- **--tor** : Download files via the Tor network
125120
- **--verbose** : Show domains being scored
126121
- **--very-verbose** : Show error messages
127122

128123
```bash
129-
python aa_whoisds.py <DELTA> [--dns-twist] [--file-dir] [--kit-dir] [--level] [--log-nc] [--quiet] [--score] [--threads] [--timeout] [--tor] [--verbose] [--very-verbose]
124+
python aa_whoisds.py <DELTA> [--dns-twist] [--directory] [--level] [--log-nc] [--quiet] [--score] [--threads] [--timeout] [--tor] [--verbose] [--very-verbose]
130125
```
131126

132127
### Things to know
@@ -141,6 +136,11 @@ python aa_whoisds.py <DELTA> [--dns-twist] [--file-dir] [--kit-dir] [--level] [-
141136
- **Triggered**: a domain was found with the minimum score specified
142137
- **Download**: checks passed and a download was started
143138
- **Complete**: download complete or the site canceled it prematurely
139+
- **Directory**: the output directory is unavailable
140+
- If the keywords in `config.yaml` have been modified and `--dns-twist` is going to be used, regenerate `dns_twisted.yaml` by running the following command:
141+
```bash
142+
bash dnstwist.sh PATH_TO_DNSTWIST_SCRIPT
143+
```
144144
- Using the `--dns-twist` flag will default to a minimum of 20 threads
145145
146146
Please fork, create merge requests, and help make this better.

0 commit comments

Comments
 (0)