Poc for flooding phishing kit with fake data

phishflood.go

package main

import (
    "fmt"
    "math/rand"
    "net/http"
    "net/url"
    "time"
    "os"
    "github.com/gocolly/colly"
)

var (
    px = [...]string{
	/*
	Specify proxies here in the form of
	"http://IP:PORT"
	*/
    }
)

func MakeRequest(i int, postAction string, inputNames []string, inputTypes []string, ch chan<- string) {

    // make post request using proxy
    proxyURL, err := url.Parse(px[i%len(px)])
    if err != nil {
			fmt.Fprintf(os.Stderr, "Error parsing the proxy address\n")
			os.Exit(1)
    }

    myClient := &http.Client{Timeout: 15 * time.Second, Transport: &http.Transport{Proxy: http.ProxyURL(proxyURL)}}

    // generate fake data
    vals := url.Values{}
    for i, valName := range inputNames {

			// "cellulare" stands for mobile phone, so we have a particular interval to make it realistic
			if valName == "cellulare" {
	    	val := rand.Intn(3499999999-3200000000) + 3200000000
	    	vals.Set(valName, fmt.Sprintf("%d", val))

	    	// these are generic numbers
			} else if inputTypes[i] == "number" {
	    	val := rand.Intn(99999999-10000000)+10000000
	    	vals.Set(valName, fmt.Sprintf("%d",val))
			}
		}

    // make the POST request
    resp, err := myClient.PostForm(postAction, vals)

    // print error
    if err != nil {
			ch <- fmt.Sprintf("Request #%d terminated with error: %s", i+1, err)
    } else {
			// send to the channel the status code of the POST
			ch <- fmt.Sprintf("Request #%d with these parameters {codice: %s,",
				"cellulare: %s, password: %s} returned the following status code:",
				"%d %s.", i+1, vals.Get("codice"), vals.Get("cellulare"),
				vals.Get("password"), resp.StatusCode, http.StatusText(resp.StatusCode))
    }
}


func getPostData(phishingUrl string)(string, []string, []string) {

    // create colly collector
    c := colly.NewCollector()
    postAction := ""
    var inputNames []string
    var inputTypes []string


    // check every form in the HTML
    c.OnHTML("form[method=post]", func(e *colly.HTMLElement) {
			action := e.Attr("action")
			postAction = phishingUrl + action

			// find name and types of input tags
			e.ForEach("input", func(_ int, login *colly.HTMLElement) {
	    	inputNames = append(inputNames, login.Attr("name"))
	    	inputTypes = append(inputTypes, login.Attr("type"))
			})

    })

    // start the collector
    c.Visit(phishingUrl)

    return postAction, inputNames, inputTypes
}

func main() {

    // check we have one input provided
    if len(os.Args) != 2 {
			fmt.Fprintf(os.Stderr, "Please specify one URL: ./phishflood *URL* \n")
			os.Exit(1)
    }

    // take a url from input
    phishingUrl := os.Args[1]

    // validate url provided
    if _, err := url.ParseRequestURI(phishingUrl); err != nil {
			fmt.Fprintf(os.Stderr, "It was not possible to parse the URL \n")
			os.Exit(1)
    }

    // navigate to it and print findings
    postAction, inputNames, inputTypes := getPostData(phishingUrl)
    fmt.Printf("[!] Found a form with action: %s \n[!] Input fields names found: %v\n[!] Input fields types found: %v\n\n", postAction, inputNames, inputTypes)

    // set random seed
    rand.Seed(time.Now().UnixNano())

    // create channel used for goroutines
    ch := make(chan string)

    // specify the number of goroutines to use
    routines := 10

    // start routines
    for i := 0; i < routines; i++ {

			// create wait for a random number of seconds between 2 and 10
			w := int(rand.Intn(10000-2000) + 2000)
			time.Sleep(time.Duration(w) * time.Millisecond)

			// send requests with fake data
			go MakeRequest(i, postAction, inputNames, inputTypes, ch)
    }

    // when POST request is completed, print the status code from the channel
    for i := 0; i < routines; i++ {
			fmt.Println(<-ch)
    }

}