update group: blackcat / alphV

FafnerKeyZee commented 2 years ago

host location

alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion

group name

alphV, alreay exist in your base

group information

New parser 'cause they use (, ), | in the Topic... Perhaps should work on a more generic regex.

host

v3 (onion)

parser

egrep -o 'class="mat-h2">([[:alnum:]]|\ |\.|\||\(|\))+</h2' source/alphav-*.html | cut -d '>' -f 2 | cut -d '<' -f 1

soufianetahiri commented 2 years ago

It could be done via their API https://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion/api/blog/all/0/{0} no need to parse.

joshhighet commented 2 years ago

appears to no longer server over https, standard requests return a 500

* SOCKS5 connect to alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion:80 (remotely resolved)
* SOCKS5 request granted.
* Connected to localhost (127.0.0.1) port 9050 (#0)
> GET /api/blog/all/0/0 HTTP/1.1
> Host: alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion
> User-Agent: curl/7.79.1
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 500 Internal Server Error
< server: nginx/1.21.4
< date: Tue, 12 Apr 2022 01:02:42 GMT
< content-length: 0

ref schema https://gist.github.com/joshhighet/08adf16dbb066557c8f3530f506e2f00

the below somewhat does what i'm after - but would be terribly useful to understand how this endpoint is incrementing

curl --silent --socks5-hostname localhost:9050 \
'http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion/api/blog/all/0/6' \
| jq -r '.items[].title'

joshhighet / ransomwatch