openSquat is a CLI tool for detecting domain squatting threats including phishing, typosquatting, IDN homograph attacks, doppelgänger domains, and bitsquatting. It operates in three modes: Community (free NRD feed), Premium Feed (paid NRD feed with local Levenshtein detection), and Premium API (server-side lookalike API queries). The tool processes keywords against domain feeds using optimized Levenshtein distance with early exit, integrates with VirusTotal, Quad9 DNS, Certificate Transparency, and phishing databases, and outputs results in TXT, JSON, or CSV formats. Architecture features modular components for feed management, DNS validation, squatting detection, API client, and output handling, with parallel processing for performance.
Seeker is a CLI-based social engineering tool that hosts fake web pages designed to trick users into granting geolocation permissions. When a victim visits the served page, JavaScript collects precise GPS coordinates, device fingerprinting data (OS, CPU cores, RAM, screen resolution, GPU, browser, IP addresses), and public IP information via ipwhois.app. The tool uses PHP's built-in server to serve the templates and handles incoming data through PHP endpoints that write to local log files. Seeker then polls these logs, stores results in CSV/KML formats, and can forward captured data to Telegram bots or Discord webhooks. It supports multiple phishing templates (Google Drive, WhatsApp, Telegram, Zoom, reCAPTCHA, and a 'NearYou' map page) and integrates with tunneling services like ngrok for public exposure. The repository is primarily a penetration testing and educational proof-of-concept, demonstrating the ease of harvesting geolocation data through deceptive web pages. While functional and well-documented, the codebase lacks tests and uses environment-variable-driven configuration to avoid interactive prompts in deployment scenarios.
Facad1ng is a command-line URL masking tool designed for security research and phishing awareness training. It takes three inputs: an original URL, a custom domain, and phishing keywords, then generates masked URLs by shortening the original URL via services like TinyURL and embedding it in a deceptive format (e.g., https://[email protected]/path). The tool demonstrates how attackers obfuscate malicious links to aid defensive security training. The core functionality is implemented in Python with input validation, multiple shortener support, and a user-friendly interface featuring ASCII art and animated loading screens.
SocialFish is a modern dynamic phishing toolkit designed for credential harvesting, session hijacking, and social engineering attacks. It provides a Flask-based web application with an admin dashboard for managing cloned login pages, capturing credentials, intercepting OTP/2FA codes, tracking victim sessions, and injecting post-capture attack payloads (e.g., keyloggers, clipboard stealers, tab jacking). The system supports browser automation via Playwright and Selenium to clone JavaScript-heavy and SPA login flows, and includes tunneling via ngrok/cloudflared for exposing phishing URLs remotely. The architecture is a monolithic Flask app with SQLite storage, WebSocket real-time updates, and a mobile API authenticated by QR tokens. External dependencies include Flask, Flask-SocketIO, Flask-Login, Playwright, Selenium, nmap, qrcode, and PyLaTeX. Despite its feature-rich surface, the codebase exhibits significant quality issues: broken async flows, missing database columns, incomplete routes, version mismatches between requirements files, and security concerns such as default credentials and insecure secret key generation. The project is actively maintained (last commit 2026-05-20) but the code is not production-ready as claimed in documentation.
This repository is a large collection of standalone Python scripts designed for the Termux environment on Android. It is marketed as an educational cybersecurity toolkit but contains functional phishing pages, credential harvesters, location trackers, camera/mic capture scripts, and a trojan for data exfiltration. The codebase also includes some legitimate utilities such as a password manager, file converter, network scanner, and backup tool. The architecture is highly fragmented: each script is self-contained with its own dependency auto-installation, Flask server, and cloudflared tunnel for public exposure. There is no shared module structure, and the code is heavily duplicated across English and Greek translations. The overall quality is low due to copy-paste patterns, hardcoded secrets, suppressed error logging, lack of testing, and reliance on external services like cloudflared. The repository poses significant legal and ethical risks due to its phishing and surveillance capabilities.