SANS ISC: Automated twitter loot collection

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

Twitter is a great place to find interesting things, being shared by fellow security researchers. If you search for keywords like #opendir or hxxp://, you'll get lots of links with open directories containing shells, control panels, sources, phishing sites or malware. Secops is hard, even for people with malicious intents.

Because many of these links are taken down quickly I've created a small application, Lootbox. Lootbox will query twitter for certain keywords, extract the links and recursively download all files. I've been running this tool for a few weeks now and it downloaded some really interesting files:
 
* multi purpose phishing sites source code, against aol, google, office365 and yahoo
* all kind of different phishing source codes like onedrive, paypal, alibaba, blockchain.info
* DiamondFox webpanel source code
* many malicous executables, scripts, installers & documents (word, excel)

The source codes gives insights in modus operandi, actors, potential weaknesses and tactics being using within phishing sites and web panels.

If you want to collect your own loot, Lootbox is opensource and can be found at github.com/dutchcoders/lootbox. If you use docker, just start dockerize.sh to create the image, update run.sh with your configuration and start the container by executing run.sh. Don't forget to mount bind your destination folder to /loot.

References:
* https://github.com/dutchcoders/lootbox

Remco Verhoef (@remco_verhoef)
ISC Handler - Founder of DutchSec
PGP Key