urlcrazy - Generate and test domain typos and variations to d

项目说明

![License]() !Stable Release ![Repositories]()

😜⌨ URLCrazy

URLCrazy is an OSINT tool to generate and test domain typos or to detect or perform typo squatting, URL hijacking, phishing, and corporate espionage.

Homepage:

🌟 Use Cases

* Detect typo squatters profiting from typos on your domain name
* Protect your brand by registering popular typos
* Identify typo domain names that will recei intended for another domain
* Conduct phishing attacks during a penetration test

⭐ Features

* Generates 17 types of domain
* Knows over 8000 common misspellings
* Over 1500 Top Le supported
* Bit-flipping attacks
* Multiple keyboard layouts (QWERTY, AZERTY, QWERTY, DVORAK)
* Checks if a domain is valid
* Test if domain are in use
* Estimate popularity of a domain

🛠 Installation

Install from a package manager

If you are using Kali Linux, Ubuntu or Debian use:

$ sudo apt install urlcrazy

Install latest release

Visit

Install current de

Be aware the latest de may not be stable.

$ git clone

Install Ruby

URLCrazy has been tested with Ruby 2.4 and 2.6.

If you are using Ubuntu or Debian use:

$ sudo apt install ruby ruby-de

Install Bundler

Bundler provides dependecy management for Ruby projects

$ gem install bundler

Install Dependencies

$ bundle install

Alternatively, if you don't want to install bundler, the following command will install the gem dependencies.

$ gem install json colorize async async-dns async-http

💻 Usage

!urlcrazy-usage

Simple Usage

With default options, URLCrazy will check over 2000 typo for google.com.

$ urlcrazy google.com

!urlcrazy-google

With popularity estimate

$ urlcrazy -p domain.com

Commandline Usage

🔦 Types of Domain Supported

Character Omission

These typos are created by leaving out a letter of the domain name, one letter at a time. For example, www.goole.com and www.gogle.com

Character Repeat

These typos are created by repeating a letter of the domain name. For example, www.ggoogle.com and www.gooogle.com

Adjacent Character Swap

These typos are created by swapping the order of adjacent letters in the domain name. For example, www.googel.com and www.ogogle.com

Adjacent Character Replacement

These typos are created by replacing each letter of the domain name with letters to the immediate left and right on the keyboard. For example, www.googke.com and www.goohle.com

Double Character Replacement

These typos are created by replacing identical, consecuti of the domain name with letters to the immediate left and right on the keyboard. For example, www.gppgle.com and www.giigle.com

Adjacent Character Insertion

These typos are created by inserting letters to the immediate left and right on the keyboard of each letter. For example, www.googhle.com and www.goopgle.com

Missing Dot

These typos are created by omitting a dot from the domainname. For example, wwwgoogle.com and www.googlecom

Strip Dashes

These typos are created by omitting a dash from the domainname. For example, www.domain-name.com becomes www.domainname.com

Singular or Pluralise

These typos are created by making a singular domain plural and vice versa. For example, www.google.com becomes www.googles.com and www.games.co.nz becomes www.game.co.nz

Common Misspellings

Over 8000 common misspellings from Wikipedia. For example, www.youtube.com becomes www.youtub.com and www.abseil.com becomes www.absail.com

Vowel Swapping

Swap within the domain name except for the first letter. For example, www.google.com becomes www.gaagle.com.

Homophones

Over 450 sets of words that sound the same when spoken. For example, www.base.com becomes www.bass.com.

Bit Flipping

Each letter in a domain name is an 8bit character. The character is substituted with the set of valid characters that can be made after a single bit flip. For example, facebook.com becomes bacebook.com, dacebook.com, faaebook.com,fabebook.com,facabook.com, etc.

Homoglyphs

One or more characters that look similar to another character but are different are called homogylphs. An example is that the lower case l looks similar to the numeral one, e.g. l vs 1. For example, google.com becomes goog1e.com.

Wrong Top Le

For example, www.trademe.co.nz becomes www.trademe.co.nz and www.google.com becomes www.google.org
Uses the 19 most common top le.

Wrong Second Le

Uses an alternate, valid second le for the top le.
For example, www.trademe.co.nz becomes www.trademe.ac.nz and www.trademe.iwi.nz

Domain Prefix

These typos are created by adding a prefix from the prefix-dictionary.txt file with a hyphen to the domain name.
For example, example.com becomes login-example.com and corp-example.com

Domain Suffix

These typos are created by adding a suffix from the suffix-dictionary.txt file with a hyphen to the domain name.
For example, example.com becomes example-login.com and example-microsoft.com

⌨ Supported Keyboard Layouts

Keyboard layouts supported are:

* QWERTY
* AZERTY
* QWERTZ
* DVORAK

🕯 Is the domain valid?

URLCrazy has a database of valid top level and second le. This information has been compiled from Wikipedia and domain registrars. We know whether a domain is valid by checking if it matches top level and second le. For example, www.trademe.co.bz is a valid domain in Belize which allows any second le registrations but www.trademe.xo.nz isn't because xo.nz isn't an allowed second le in New Zealand.

💡 Popularity Estimate

URLCrazy pioneered the technique of estimating the relati of a typo from search engine results data. By measuring how many times a typo appears in webpages, we can estimate how popular that typo will be made when users type in a URL.

The inherent limitation of this technique, is that a typo for one domain, can be a legitimate domain in its own right. For example, googles.com is a typo of google.com but it also a legitimate domain.

For example, consider the following typos for google.com.

| Count. | Typo |
| ------ | ------------ |
| 25424 | gogle.com |
| 24031 | googel.com |
| 22490 | gooogle.com |
| 19172 | googles.com |
| 19148 | goole.com |
| 18855 | googl.com |
| 17842 | ggoogle.com |

🔧 Troubleshooting

MacOS File Descriptor Limit

If DNS resolution fails under Macos it could be due to the small default file descriptor limit.

To display the current file descriptor limit use:

$ ulimit -a

To increase the file descriptor limit use:

$ ulimit -n 10000

No results for Wrong TLDs

Check your ulimit and set it to 10000 or a number higher than number of hostnames you are processing.

💣 Known Issues

No WHOIS checking

This tool does not check if a domain has been registered. This is due to WHOIS servers enforcing rate-limiting and banning IP addresses.

👏 URLCrazy Appearances

Kali Linux

URLCrazy was a default tool in BackTrack 5, and later Kali Linux.

The Browser Hacker's Handbook

Authored by Wade Alcorn, Christian Frichot, and Michele Orru.

URLCrazy is included in Chapter 2 of this seminal work on the topic.

PTES Technical Guidelines

Penetration Testing Execution Standard (PTES) is a standard designed to provide a common language and scope for performing penetration testing (i.e. Security e). URLCrazy is included in the Tools Required section.

Network Security Toolkit

Network Security Toolkit is a bootable Linux distribution designed to provide easy access to best-of-breed Open Source Network Security Applications.

📚 Other Projects

URLCrazy was first published in 2009, and for many years was the most ad opensource tool for studying typosquatting. Since then multiple other tools have been de by the infosec community.

DNSTwist

DNSTwist is de by Marcin Ulikowski and first published in 2015. DNSTwist had a significant feature o with URLCrazy at the time, and introduced many new features.

Language: Python

URLInsane

URLInsane was de by Rangertaha in 2018 and claims to match the features of URLCrazy and DNSTwist.

Language: Go

DomainFuzz

DomainFuzz was de by monkeym4sterin 2017.
Language: Node.JS

😎 Authors and Acknowledgement

De by Andrew Horton ().

Thanks to Ruby on Rails for Inflector which allows plural and singular permutations.

Thanks to Wikipedia for the set of common misspellings, homophones, and homoglyphs.

Thanks to software77.net for their IP to country database

🙋 Community

Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.

Please make sure to update tests as appropriate.

📄 License

Copyright Andrew Horton, 2012-2021. You ha to use and distribute this software. You do not ha to distribute modified without permission. You do not ha to use this as part of a commercial service unless it forms part of a penetration testing service. For example a commercial service that provides domain protection for clients must obtain a license first. Email me if you require a license.

项目信息

开发语言：Ruby

Star 数：695

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Generate and test domain typos and variations to detect and perform typo squatting, URL hijacking, phishing, and corporate espionage.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。