Awesome

This tool is outdated

CatMyPhish

Search for categorized domain that can be used during red teaming engagement. Perfect to setup whitelisted domain for your Cobalt Strike beacon C&C.

It relies on expireddomains.net to obtain a list of expired domains. The domain availability is validated using checkdomain.com

Usage

$ python CatMyFish.py -h
CatMyPhish v1.0 - Search for available already categorized domain
Mr.Un1k0d3r - RingZer0 Team 2016

usage: CatMyPhish.py [-h] [-v] [-e] [-f FILENAME] [-o OUTPUT]
                    [keywords [keywords ...]]

positional arguments:
  keywords              Keyword to use when search for expired domains

optional arguments:
  -h, --help            show this help message and exit
  -v, --verbose         More verbose output
  -e, --exitone         Stop querying Symantec after first success
  -f FILENAME, --filename FILENAME
                        Loads domains to check from a text file, instead of
                        searching
  -o OUTPUT, --output OUTPUT
                        Write unregistered, categorized domains to a file.

Example

$ python CatMyPhish.py sugar
CatMyPhish v1.0 - Search for available already categorized domain
Mr.Un1k0d3r - RingZer0 Team 2016

[+] (25) domains found using the keyword "sugar".
[+] Symantec categorization check may take several minutes. Bot check is pretty aggressive...
[+] Potential candidate: SugarNines.com categorized as Personal Sites.
[+] Potential candidate: CreativeSugarFlowers.com categorized as Restaurants/Dining/Food.
[+] Potential candidate: mysugargrove.com categorized as Society/Daily Living.
[+] Potential candidate: SugarTreeScrapbook.com categorized as Society/Daily Living.
[+] Potential candidate: SugarlandMania.com categorized as Entertainment.
[+] Potential candidate: SugarTreeProperties.com categorized as Real Estate.
[+] Potential candidate: BloodSugarTips.com categorized as Health.
[+] Potential candidate: SugarmillWoodsNews.com categorized as Real Estate.
[+] (8) candidates found.
[+] Awesome "SugarNines.com" is categorized and available.
[+] Awesome "CreativeSugarFlowers.com" is categorized and available.
[+] Awesome "mysugargrove.com" is categorized and available.
[+] Awesome "SugarTreeScrapbook.com" is categorized and available.
[+] Awesome "SugarlandMania.com" is categorized and available.
[+] Awesome "SugarTreeProperties.com" is categorized and available.
[+] Awesome "BloodSugarTips.com" is categorized and available.
[+] Awesome "SugarmillWoodsNews.com" is categorized and available.
[+] Search completed.

Warning

the Symantec categorization search is slow to avoid captcha. Using proxychains and Tor is a good workaround.

TODO

• Categorization check against other vendors.
• Populate the blacklisted categories

Credit

Mr.Un1k0d3r RingZer0 Team