OWASP Phishycat Project

• Main
• FAQs
• Acknowledgements
• Road Map and Getting Involved
• Minimum Viable Product

OWASP Phishycat Project OWASP Phishycat is a phishing detection framework. It detects a phishing page and show alert to the user. Currently, it only supports chrome browser. This project also includes a plugin called "Phishblocker" to communicate with browser and back-end server. It can be extended in other platforms as well. Description OWASP Phishycat is a phishing detection framework. Main idea here is to guess the original domain that attacker is trying to phish. Next, it performs the test by doing real time image comparison and DOM analysis of both web pages (Original domain and phishing domain). Original domains should be registered in project database before it goes for testing. Once it guess the domain name then it compares the real time images of both web pages (phishing site and original website) . Attacker will try to make the web page design look similar to original website as much as possible. If both images are similar to each other, then next step is to compare DOM of both web pages. If it does not match then there is a high chance that it is a phishing site. Because, we can say two web pages are similar only when every elements of the pages are identical. In this case, we have similar looking two websites but their DOM is different. We take the phishing domain and try to match it with all the registered domain names. If similar looking domain name exist in project database then we do the real time image checking of both web pages. If image check is true, we proceed with real time DOM analysis of both web pages. Here we are assuming that phishing domain name is similar to original domain, which may not be the case always. In future, We can implement services like text analysis in a webpage and find the focused keywords, it will help us to get the idea of original domain. Licensing OWASP Phishycat is free to use. It is licensed under the Apache License 2.0 https://apache.org/licenses/LICENSE-2.0.html

Project Resources This is where you can link to the key locations for project files, including setup programs, the source code repository, online documentation, a Wiki Home Page, threaded discussions about the project, and Issue Tracking system, etc. Current github: https://github.com/abhijitio/ Compiled DLLs Source Code Documentation Wiki Home Page Issue Tracker Slide Presentation Video Project Leader A project leader is the individual who decides to lead the project throughout its lifecycle. The project leader is responsible for communicating the project’s progress to the OWASP Foundation, and he/she is ultimately responsible for the project’s deliverables. The project leader must provide OWASP with his/her real name and contact e-mail address for his/her project application to be accepted, as OWASP prides itself on the openness of its products, operations, and members. Project leader's name Related Projects This is where you can link to other OWASP Projects that are similar to yours. OWASP_Code_Tool_Template OWASP_Documentation_Project_Template Classifications

News and Events This is where you can provide project updates, links to any events like conference presentations, Project Leader interviews, case studies on successful project implementations, and articles written about your project. [18 Dec 2013] 1.0 Release Candidate is available for download. This release provides final bug fixes and product stabilization. Any feedback (good or bad) in the next few weeks would be greatly appreciated. [20 Nov 2013] 1.0 Beta 2 Release is available for download. This release offers several bug fixes, a few performance improvements, and addressed all outstanding issues from a security audit of the code. [30 Sep 2013] 1.0 Beta 1 Release is available for download. This release offers the first version with all of the functionality for a minimum viable product.

How can I participate in your project?

All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

If I am not a programmer can I participate in your project?

Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.

Volunteers

The OWASP Security Principles project is developed by a worldwide team of volunteers. A live update of project contributors is found here.

The first contributors to the project were:

• Abhijit Chatterjee who created the MVP.

WHAT'S COMING

Roadmap

As of June 2017, the highest priorities for the next 3 months are:

• Complete the text analysis to find the focused keyword and less dependency on domain name analysis.
• Database integration to properly maintain the registered domains.
• Get other people to review the Code Project Template and provide feedback.
• Develop plugin for Firefox.
• Mobile Application support.

Subsequent Releases will add

• Threshold value for image checking to avoid false positives.
• Threshold value for DOM analysis to avoid false positives.

Getting Involved

Involvement in the development and promotion of Code Project Template is actively encouraged! You do not have to be a security expert or a programmer to contribute. Some of the ways you can help are as follows:

Coding

We could implement some of the later items on the roadmap sooner if someone wanted to help out with unit or automated regression tests

Localization

Are you fluent in another language? Can you help translate the text strings in the Code Project Template into that language?

Testing

Do you have a flair for finding bugs in software? We want to product a high quality product, so any help with Quality Assurance would be greatly appreciated. Let us know if you can offer your help.

Feedback

Please use the Code Project Template project mailing list for feedback about:

• What do like?
• What don't you like?
• What features would you like to see prioritized on the roadmap?

Minimum Viable Product of OWASP Phishycat Project can be found here :- https://github.com/abhijitio/OWASP-Phishycat