Ditto - A Tool For IDN Homograph Attacks And Detection - Hacking Land

Ditto is a small tool that accepts a domain name as input and generates all its variants for an homograph attack as output, checking which ones are available and which are already registered.

PoC domains

Using with Docker

The image on docker hub is updated on every push, you can just:

docker run evilsocket/ditto -h

Compiling from sources

Compiling from sources requires the go compiler, this will install the binary in $GOPATH/bin:

# make sure go modules are usedGO111MODULE=on go get github.com/evilsocket/ditto/cmd/ditto

Usage

To only transform a string:

ditto -string google

For a domain:

ditto -domain facebook.com

Use more concurrent workers to increase speed (WARNING: might cause a temporary IP ban from the WHOIS servers):

ditto -workers 4 -domain facebook.com

If instead of mutating the domain name you want to check other TLDs (throttle is set to 1s in order to avoid being blocked by WHOIS servers due to the many requests in a short timeframe):

ditto -domain facebook.com -tld -throttle 1000 -limit 100

Only show available domains:

ditto -domain facebook.com -available

Only show registered domains:

ditto -domain facebook.com -registered

Only show registered domains that resolve to an IP:

ditto -domain facebook.com -live

Show WHOIS information:

ditto -domain facebook.com -live -whois

Save to CSV file with extended WHOIS information:

ditto -domain facebook.com -whois -csv output.csv

Keep running and monitoring for changes every hour:

ditto -domain facebook.com -monitor 1h

The same but also keep and store the changes as JSON files:

ditto -domain facebook.com -monitor 1h -changes /some/path -keep-changes

Execute a command if changes have been detected (see example send-email-report.sh in this repo, automatically added to the docker image):

    ditto -domain facebook.com \          -monitor 1h \          -trigger "/usr/bin/send-email-report.sh {{.Domain}} {{.ChangesFile}} [email protected]"

For more options: