Easily launch a new phishing site fully presented with SSL and capture credentials along with 2FA tokens using CredSniper. The API provides secure access to the currently captured credentials which can be consumed by other applications using a randomly generated API token. ## Benefits * Fully supported SSL via Let’s Encrypt * Exact login form clones for realistic phishing * Any number of intermediate pages * (i.e. Gmail login, password and two-factor pages then a redirect) * Supports phishing 2FA tokens * API for integrating credentials into other applications * Easy to personalize using a templating framework ![Phishing Framework with 2FA Token Support: CredSniper](https://d21ic6tdqjqnyw.cloudfront.net/wp-content/uploads/2017/11/02123805/blackhills-250x250.png) ## Basic Usage credsniper.py [-h] --module MODULE [--twofactor] [--port PORT] [--ssl] [--verbose] --final FINAL --hostname HOSTNAME optional arguments: -h, --help show this help message and exit --module MODULE phishing module name - for example, "gmail" --twofactor enable two-factor phishing --port PORT listening port (default: 80/443) --ssl use SSL via Let's Encrypt --verbose enable verbose output --final FINAL final url the user is redirected to after phishing is done --hostname HOSTNAME hostname for SSL ### Credentials ** .cache ** : Temporarily store username/password when phishing 2FA ** .sniped ** : Flat-file storage for captured credentials and other information ### API End-point * View Credentials (GET) ` https:///creds/view?api_token= ` * Mark Credential as Seen (GET) ` https:///creds/seen/?api_token= ` * Update Configuration (POST) ` https:///config ` { 'enable_2fa': true, 'module': 'gmail', 'api_token': 'some-random-string' } ### Modules All modules can be loaded by passing the ` --module ` command to CredSniper. These are loaded from a directory inside ` /modules ` . CredSniper is built using [ Python Flask ]() and all the module HTML templates are rendered using [ Jinja2 ]() . * ** Gmail ** : The latest Gmail login cloned and customized to trigger/phish all forms of 2FA * ** modules/gmail/gmail.py ** : Main module loaded w/ –module gmail * ** modules/gmail/templates/error.html ** : Error page for 404’s * ** modules/gmail/templates/login.html ** : Gmail Login Page * ** modules/gmail/templates/password.html ** : Gmail Password Page * ** modules/gmail/templates/authenticator.html ** : Google Authenticator 2FA page * ** modules/gmail/templates/sms.html ** : SMS 2FA page * ** modules/gmail/templates/touchscreen.html ** : Phone Prompt 2FA page ![Phishing Framework with 2FA Token Support: CredSniper](https://d21ic6tdqjqnyw.cloudfront.net/wp-content/uploads/2017/11/02123757/credsniper.jpg) ## Installation * * * You can install and run automatically with the following command: $ git clone https://github.com/ustayready/CredSniper $ cd CredSniper ~/CredSniper$ ./install.sh Then, to run manually use the following commands: ~/$ cd CredSniper ~/CredSniper$ source bin/activate (CredSniper) ~/CredSniper$ python credsniper.py --help Note that Python 3 is required. [ ![Phishing Framework with 2FA Token Support: CredSniper Download](https://d21ic6tdqjqnyw.cloudfront.net/wp-content/uploads/2016/05/08082805/Download3-1024x154.png) ]()