Re: [nznog] Bankdirect phish - perl script
Liz Q
30/09/2005 09:49 >>> If a few of you were to run this in a loop it may screw things up for
I'd suggest that the loop have a longish sleep - say 10 seconds or so - so that it does not look like a denial of service attack. R them #!/usr/bin/perl -w my $url = "http://www.bankdlrect.co.nz/Logon.html"; use WWW::Mechanize; use String::Random; $randstuff = new String::Random; my $fakeuser = $randstuff->randregex('\d\d\d\d\d\d\d\d'); # Prints random digits my $fakepass = $randstuff->randpattern("........"); # Prints random printable characters my $mech = WWW::Mechanize->new(); $mech->get( $url ); #$mech->follow_link( n => 3 ); #$mech->follow_link( text_regex => qr/download this/i ); #$mech->follow_link( url => 'http://host.com/index.html' ); $mech->submit_form( form_number => 1, fields => { username => '$fakeuser', password => 'fakepass', } ); print "Logging into $url with $fakeuser and $fakepass\n"; Liz On Fri, 30 Sep 2005 08:55, James Clark wrote:
Craig Box wrote:
Just got a phish for BankDirect. The telling part: "<a href="http://www.bankdlrect.co.nz/index_secure.asp" >"
I've seen this phish aswell.
Cheers, James.
_______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog
-- It's a poor sort of memory that only works backwards. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog
Webmaster wrote:
I'd suggest that the loop have a longish sleep - say 10 seconds or so - so that it does not look like a denial of service attack.
The host used to forward usernames/passwords to the phisher is likely a compromised box belonging to someone unaware of the situation. Looks like it's in Japan... admins there are usually good about responding, in my experience. IMO, it'd make more sense to trace the origin of the phisher instead of bombarding that box with bogus data that's easy enough to filter out. -- Juha Pas de conneries la!
SRS zone push happened 10 minutes ago. (It is pushed out hourly now) So the site/domain is dead and the whole thing has become a moot point. :) Mark. -----Original Message----- From: Juha Saarinen [mailto:juha(a)saarinen.org] Sent: Friday, 30 September 2005 10:08 a.m. To: Webmaster Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Bankdirect phish - perl script Webmaster wrote:
I'd suggest that the loop have a longish sleep - say 10 seconds or so - so that it does not look like a denial of service attack.
The host used to forward usernames/passwords to the phisher is likely a compromised box belonging to someone unaware of the situation. Looks like it's in Japan... admins there are usually good about responding, in my experience. IMO, it'd make more sense to trace the origin of the phisher instead of bombarding that box with bogus data that's easy enough to filter out. -- Juha Pas de conneries la! _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog
participants (3)
-
Juha Saarinen
-
Mark Karena
-
Webmaster