Package: ail-typo-squatting
ail-typo-squattingail-typo-squatting is a Python library to generate list of potential typo squatting domains with domain name permutation engine to feed AIL and other systems.The tool can be used as a stand-alone tool or to feed other systems.RequirementsPython 3.6+inflectlibrarypyyamltldextractdnspythonInstallationSource installail-typo-squatting can be install with poetry. If you don't have poetry installed, you can do the followingcurl -sSL https://raw.githubusercontent.com/python-poetry/poetry/master/get-poetry.py | python.$poetryinstall
$poetryshell
$cdail-typo-squatting
$pythontypo.py-hpip installation$pip3installail-typo-squattingUsagedacru@dacru:~/git/ail-typo-squatting/bin$python3typo.py--helpusage:typo.py[-h][-v][-dnDOMAINNAME[DOMAINNAME...]][-fdnFILEDOMAINNAME][-oOUTPUT][-foFORMATOUTPUT][-br][-dnsr][-dnsl][-lLIMIT][-var][-ko][-a][-om][-repe][-repl][-drepl][-cho][-add][-md][-sd][-vs][-ada][-hg][-ahg][-cm][-hp][-wt][-wsld][-at][-sub][-sp][-cdd][-addns][-uddns][-ns][-combo][-ca]optionalarguments:-h,--helpshowthishelpmessageandexit-vverbose,moredisplay-dnDOMAINNAME[DOMAINNAME...],--domainNameDOMAINNAME[DOMAINNAME...]listofdomainname-fdnFILEDOMAINNAME,--filedomainNameFILEDOMAINNAMEfilecontaininglistofdomainname-oOUTPUT,--outputOUTPUTpathtoouputlocation-foFORMATOUTPUT,--formatoutputFORMATOUTPUTformatfortheoutputfile,yara-regex-yaml-text.Default:text-br,--betterregexUseretrieforfasterregex-dnsr,--dnsresolvingresolveallvariationofdomainnametoseeifit'supornot-dnsl,--dnslimitedresolveallvariationofdomainnamebutkeeponlyupdomaininfinalresultjson-lLIMIT,--limitLIMITlimitofvariationsforadomainname-var,--givevariationsgivethealgothatgeneratevariations-ko,--keeporiginalKeepintheresultlisttheoriginaldomainname-a,--allUseallalgo-om,--omissionLeaveoutaletterofthedomainname-repe,--repetitionCharacterRepeat-repl,--replacementCharacterreplacement-drepl,--doublereplacementDoubleCharacterReplacement-cho,--changeorderChangetheorderoflettersinword-add,--additionAddacharacterinthedomainname-md,--missingdotDeleteadotfromthedomainname-sd,--stripdashDeleteofadashfromthedomainname-vs,--vowelswapSwapvowelswithinthedomainname-ada,--adddashAddadashbetweenthefirstandlastcharacterinastring-hg,--homoglyphOneormorecharactersthatlooksimilartoanothercharacterbutaredifferentarecalledhomogylphs-ahg,--all_homoglyphgenerateallpossiblehomoglyphpermutations.Ex:circl.lu,e1rc1.lu-cm,--commonmisspellingChangeawordbyismisspellings-hp,--homophonesChangewordbyanotherwhosoundthesamewhenspoken-wt,--wrongtldChangetheoriginaltopleveldomaintoanother-wsld,--wrongsldChangetheoriginalsecondleveldomaintoanother-at,--addtldAddingatldbeforetheoriginaltld-sub,--subdomainInsertadotatvaryingpositionstocreatesubdomain-sp,--singularpluralizeCreatebymakingasingulardomainpluralandviceversa-cdd,--changedotdashChangedottodash-addns,--adddynamicdnsAdddynamicdnsattheendofthedomain-uddns,--updatedynamicdnsUpdatedynamicdnswarninglist-ns,--numeralswapChangeanumberstowordsandviceversa.Ex:circlone.lu,circl1.lu-comboCombinemultiplealgoonadomainname-ca,--catchallCombinewith-dnsr.Generatearandomstringinfrontofthedomain.Usage exampleCreation of variations forail-project.organdcircl.lu, using all algorithm.dacru@dacru:~/git/ail-typo-squatting/bin$python3typo.py-dnail-project.orgcircl.lu-a-o.Creation of variations for a file who contains domain name, using character omission - subdomain - hyphenation.dacru@dacru:~/git/ail-typo-squatting/bin$python3typo.py-fdndomain.txt-co-sub-hyp-o.-foyaraCreation of variations forail-project.organdcircl.lu, using all algorithm and using dns resolution.dacru@dacru:~/git/ail-typo-squatting/bin$python3typo.py-dnail-project.orgcircl.lu-a-dnsr-o.Creation of variations forail-project.organd give the algorithm that generate the variation (only for text format).dacru@dacru:~/git/ail-typo-squatting/bin$python3typo.py-dnail-project.org-a-o--varUsed as a libraryTo run all algorithmsfromail_typo_squattingimportrunAllimportmathresultList=list()domainList=["google.com"]formatoutput="yara"pathOutput="."fordomainindomainList:resultList=runAll(domain=domain,limit=math.inf,formatoutput=formatoutput,pathOutput=pathOutput,verbose=False,givevariations=False,keeporiginal=False)print(resultList)resultList=list()To run specific algorithmfromail_typo_squattingimportformatOutput,omission,subdomain,addDashimportmathresultList=list()domainList=["google.com"]limit=math.infformatoutput="yara"pathOutput="."fordomainindomainList:resultList=omission(domain=domain,resultList=resultList,verbose=False,limit=limit,givevariations=False,keeporiginal=False)resultList=subdomain(domain=domain,resultList=resultList,verbose=False,limit=limit,givevariations=False,keeporiginal=False)resultList=addDash(domain=domain,resultList=resultList,verbose=False,limit=limit,givevariations=False,keeporiginal=False)print(resultList)formatOutput(format=formatoutput,resultList=resultList,domain=domain,pathOutput=pathOutput,givevariations=False)resultList=list()Sample outputThere's4 formatpossible for the output file:textyararegexsigmaForTextfile, each line is a variation.ail-project.org
il-project.org
al-project.org
ai-project.org
ailproject.org
ail-roject.org
ail-poject.org
ail-prject.org
ail-proect.org
ail-projct.org
ail-projet.org
ail-projec.org
aail-project.org
aiil-project.org
...ForYarafile, each rule is a variation.rule ail-project_org {
    meta:
        domain = "ail-project.org"
    strings: 
        $s0 = "ail-project.org"
        $s1 = "il-project.org"
        $s2 = "al-project.org"
        $s3 = "ai-project.org"
        $s4 = "ailproject.org"
        $s5 = "ail-roject.org"
        $s6 = "ail-poject.org"
        $s7 = "ail-prject.org"
        $s8 = "ail-proect.org"
        $s9 = "ail-projct.org"
        $s10 = "ail-projet.org"
        $s11 = "ail-projec.org"
    condition:
         any of ($s*)
}ForRegexfile, each variations is transform into regex and concatenate with other to do only one big regex.ail\-project\.org|il\-project\.org|al\-project\.org|ai\-project\.org|ailproject\.org|ail\-roject\.org|ail\-poject\.org|ail\-prject\.org|ail\-proect\.org|ail\-projct\.org|ail\-projet\.org|ail\-projec\.orgForSigmafile, each variations are list undervariationskey.title: ail-project.org
variations:
- ail-project.org
- il-project.org
- al-project.org
- ai-project.org
- ailproject.org
- ail-roject.org
- ail-poject.org
- ail-prject.org
- ail-proect.org
- ail-projct.org
- ail-projet.org
- ail-projec.orgDNS outputIn case DNS resolve is selected, an additional file will be created in JSON formateach keys are variations and may have a field "ip" if the domain name have been resolved. The filed "NotExist" will be there each time with a Boolean value to determine if the domain is existing or not.{"circl.lu":{"NotExist":false,"ip":["185.194.93.14"]},"ircl.lu":{"NotExist":true},"crcl.lu":{"NotExist":true},"cicl.lu":{"NotExist":true},"cirl.lu":{"NotExist":true},"circ.lu":{"NotExist":true},"ccircl.lu":{"NotExist":true},"ciircl.lu":{"NotExist":true},...}List of algorithms usedAlgoDescriptionAddDashThese typos are created by adding a dash between the first and last character in a string.AdditionThese typos are created by add a characters in the domain name.AddDynamicDnsThese typos are created by adding a dynamic dns at the end of the original domain.AddTldThese typos are created by adding a tld before the right tld. Example: google.com becomes google.com.itChangeDotDashThese typos are created by changing a dot to a dash.ChangeOrderThese typos are created by changing the order of letters in the each part of the domain.ComboThese typos are created by combining multiple algorithms. For example, circl.lu becomes cirl6.luCommonMisspellingThese typos are created by changing a word by is misspelling. Over 8000 common misspellings from Wikipedia. For example,www.youtube.combecomeswww.youtub.comandwww.abseil.combecomeswww.absail.com.Double ReplacementThese typos are created by replacing identical, consecutive letters of the domain name.HomoglyphThese typos are created by replacing characters to another character that look similar but are different.  An example is that the lower case l looks similar to the numeral one, e.g. l vs 1. For example, google.com becomes goog1e.com.HomophonesThese typos are created by changing word by an other who sound the same when spoken. Over 450 sets of words that sound the same when spoken. For example,www.base.combecomeswww.bass.com.MissingDotThese typos are created by deleting a dot from the domain name.NumeralSwapThese typos are created by changing a number to words and vice versa. For example, circlone.lu becomes circl1.lu.OmissionThese typos are created by leaving out a letter of the domain name, one letter at a time.RepetitionThese typos are created by repeating a letter of the domain name.ReplacementThese typos are created by replacing each letter of the domain name.StripDashThese typos are created by deleting a dash from the domain name.SingularPluralizeThese typos are created by making a singular domain plural and vice versa.SubdomainThese typos are created by placing a dot in the domain name in order to create subdomain. Example: google.com becomes goo.gle.comVowelSwapThese typos are created by swapping vowels within the domain name except for the first letter. For example,www.google.combecomeswww.gaagle.com.WrongTldThese typos are created by changing the original top level domain to another. For example,www.trademe.co.nzbecomeswww.trademe.co.mzandwww.google.combecomeswww.google.orgUses the 19 most common top level domains.WrongSldThese typos are created by changing the original second level domain to another. For example,www.trademe.co.ukbecomeswww.trademe.ac.ukandwww.google.comwill still bewww.google.com.AcknowledgmentThe project has been co-funded by CEF-TC-2020-2 - 2020-EU-IA-0260 - JTAN - Joint Threat Analysis Network.