Skip to content

Instantly share code, notes, and snippets.

View ririhedou's full-sized avatar

Ke Tian ririhedou

42 followers · 47 following
View GitHub Profile
@ririhedou
ririhedou / string-obfuscation-5572587.web.source.html
Created October 21, 2018 05:38
<html lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta charset="utf-8">
<title> Log in to your PayPaI account - United States </title>
<link rel="stylesheet" href="./lib/css/bootstrap.css">
<link rel="shortcut icon" link="" href="lib/css/img/anon-7.png">
<meta name="viewport" content="initial-scale=1.0">
</head>
<body>
<!--
_____ ______ _____ __ __ _____ _____ ______ _____ __ __ _____ _
@ririhedou
ririhedou / WEB_DOMAIN
Created May 23, 2018 20:44
infeed.id
secure-independentbank.com
indianexpress-survey.com
ikeo.com
ikea-lifeathome.com
illinois--wrongfuldeath--lawyer.com
mail.illinois-tv.com
fingerprint-illinois.com
imd.kz
omdb.site
@ririhedou
ririhedou / code
Created May 18, 2018 15:16
<script>
var api = new FBLoginAPI();
var ref = '';
if (location.href.match('utm_source')) {
ref = location.href.replace('utm_source','owner');
}
else {
ref = location.href.match('owner') ? location.href : null;
}
@ririhedou
ririhedou / Uber
Created May 7, 2018 03:24
('WEB', 41)
('MOBILE', 46)
('Intersection', 32)
('only in mobile', 'uber-voronezh.ru')
('only in mobile', 'huber-bodywear.com')
('only in mobile', 'ber.tel')
('only in mobile', 'ubet.be')
('only in mobile', 'schuber-stehsammler.com')
('only in mobile', 'zber.net')
('only in mobile', 'uber.hk')
@ririhedou
ririhedou / evasion-phash
Last active May 24, 2018 01:07
LOAD total 3491 labels
LOAD total y 1731 labels
LOAD total n 1759 labels
Brand ID 1, Name 1, verified 348
Brand ID 109, Name 109, verified 30
Brand ID 177, Name 177, verified 285
Brand ID 194, Name 194, verified 70
Brand ID 2, Name 2, verified 90
Brand ID 207, Name 207, verified 79
Brand ID 74, Name 74, verified 734
@ririhedou
ririhedou / phishing-Tank-data-statistics
Created April 23, 2018 20:50
The total records:
/mnt/sdb1/browser_phishingTank/database » cat * | wc -l ketian@ketian
11215
The total number of available IDs I can crawl 6755:
('1', 1306)
('104', 4)
('105', 1)
('107', 89)
('108', 23)
@ririhedou
ririhedou / squatting_types
Created April 22, 2018 17:13
python squat_API.py ketian@ketian
1000000
('4128', '000webhostapp.com', '62', 'blogspot.com')
('[Info]domain_tld is: ', u'paypal.com')
('[Info]base_domain is: ', u'paypal')
('[Info]tld is: ', u'com')
The analyzed domain and tld name is:
paypal com
http://paypals.center/signin
{'NO': 1179, u'typo': 1, 'combo': 126}
@ririhedou
ririhedou / Redirection
Last active May 15, 2018 15:09
Web
('TOTAL:', 990161)
('NO redirection:', 879277)
('Rerdirection', 110884)
('redirection to itself', 7709)
('Market:', 20016)
('Other', 83159)
('redirection total', 110884)
Market
{'ovh.net': 1703, 'moniker.com': 331, 'world4you.com': 375, 'com.com': 1328, 'ewebdevelopment.com': 858, 'webgo24.de': 227, 'domainhub.com': 244, 'pagesjaunes.fr': 657, 'www.eu': 312, 'goserver.host': 285, 'stairweb.de': 704, 'startpage.vg': 862, 'admarketplace.net': 497, 'wordpress.com': 279, 'uniregistry.com': 2830, 'topdns.com': 234, 'afternic.com': 474, 'hoststar.ch': 207, 'lwspanel.com': 295, 'wix.com': 591, 'markmonitor.com': 6294, 'undeveloped.com': 429}
@ririhedou
ririhedou / Android_data_backup
Last active April 23, 2018 20:24
================ March-23 =================================================
\begin{table}[!htbp]
\centering
\begin{tabular}{|l|l|l|}
\hline
& Library & App Itself \\ \hline \hline
Improper symm. Crypo & 182 (86.7\%) & 28 (13.3\%) \\ \hline
Broken Hash & 1150 (89.8\%) & 130 (10.2\%) \\ \hline
Predictable Keys & 353 (82.5\%) & 75 (17.5\%) \\ \hline
Predictable IV & 465 (87.1\%) & 69 (12.1\%) \\ \hline
@ririhedou
ririhedou / NEW_GROUNDTRUTH
Last active April 18, 2018 17:38
5446137,/mnt/sdb1/browser_phishingTank/Crawl/1/5446137.web.screen.png,1,y
5447231,/mnt/sdb1/browser_phishingTank/Crawl/1/5447231.web.screen.png,1,y
5447232,/mnt/sdb1/browser_phishingTank/Crawl/1/5447232.web.screen.png,1,y
5449155,/mnt/sdb1/browser_phishingTank/Crawl/1/5449155.web.screen.png,1,n
5449212,/mnt/sdb1/browser_phishingTank/Crawl/1/5449212.web.screen.png,1,n
5449226,/mnt/sdb1/browser_phishingTank/Crawl/1/5449226.web.screen.png,1,n
5449661,/mnt/sdb1/browser_phishingTank/Crawl/1/5449661.web.screen.png,1,n
5450011,/mnt/sdb1/browser_phishingTank/Crawl/1/5450011.web.screen.png,1,n
5450287,/mnt/sdb1/browser_phishingTank/Crawl/1/5450287.web.screen.png,1,n
5451421,/mnt/sdb1/browser_phishingTank/Crawl/1/5451421.web.screen.png,1,n