joshhighet / ransomwatch

the transparent ransomware claim tracker 🥷🏼🧅🖥️
https://ransomwatch.telemetry.ltd
The Unlicense
904 stars 135 forks source link

new group: noescape #73

Closed joshhighet closed 1 year ago

joshhighet commented 1 year ago

host location

noescapemsqxvizdxyl7f7rmg5cdjwp33pg2wpmiaaibilb4btwzttad.onion

group name

noescape

group information

also noescaperjh3gg6oy7rck57fiefyuzmj7kmvojxgvlmwd5pdzizrb7ad.onion

host

v3 (onion)

parser

No response

joshhighet commented 1 year ago

yet to find an elegant way to return claims from the blog (ending wzttad)

maiqueg commented 1 year ago

I've found two that might work.

Company name: cat NoEscape.html | grep -oe "title=\"Company name\">[^<]*" | cut -d'>' -f2

or

Victim URL: cat NoEscape.html | grep -oe "target=\"_blank\">[^<]*" | cut -d'>' -f2

The trick was using [^<] that is a character class and matches everything but a "<".

joshhighet commented 1 year ago

Thanks

The challenge is less the field extractions and more working around the scrape countermeasures in place.

I haven’t been able to return the required values using the normal requests or gecko based fetch methods that work for all other hosts.

On Tue, 20 Jun 2023 at 7:14 AM, maiqueg @.***> wrote:

I've found two that might work.

Company name: cat NoEscape.html | grep -oe "title=\"Company name\">[^<]*" | cut -d'>' -f2

or

Victim URL: cat NoEscape.html | grep -oe "target=\"_blank\">[^<]*" | cut -d'>' -f2

The trick was using [^<] that is a character class and matches everything but a "<".

maiqueg commented 1 year ago

I used your file from source/noescape*wzttad.html, that's why I thought the scraping was working fine.

joshhighet commented 1 year ago

ha… it is too. i had word wrap off 🤣 i will add in shortly, thanks for scratching together a parser @maiqueg