Automated twitter loot collection

Published: 2018-06-07
Last Updated: 2018-06-07 19:42:05 UTC
by Remco Verhoef (Version: 1)
1 comment(s)

Twitter is a great place to find interesting things, being shared by fellow security researchers. If you search for keywords like #opendir or hxxp://, you'll get lots of links with open directories containing shells, control panels, sources, phishing sites or malware. Secops is hard, even for people with malicious intents.



Because many of these links are taken down quickly I've created a small application, Lootbox. Lootbox will query twitter for certain keywords, extract the links and recursively download all files. I've been running this tool for a few weeks now and it downloaded some really interesting files:
* multi purpose phishing sites source code, against aol, google, office365 and yahoo
* all kind of different phishing source codes like onedrive, paypal, alibaba,
* DiamondFox webpanel source code
* many malicous executables, scripts, installers & documents (word, excel)

The source codes gives insights in modus operandi, actors, potential weaknesses and tactics being using within phishing sites and web panels.

If you want to collect your own loot, Lootbox is opensource and can be found at If you use docker, just start to create the image, update with your configuration and start the container by executing Don't forget to mount bind your destination folder to /loot.


Remco Verhoef (@remco_verhoef)
ISC Handler - Founder of DutchSec

1 comment(s)


I think I will set up a little curl script myself and see what I see

Diary Archives