<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-credential-harvesting-pages
description: >-
  Identify and analyze credential harvesting pages used in phishing campaigns.
  Covers DOM inspection, form action analysis, SSL certificate validation,
  visual similarity detection, and automated page classification techniques.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - credential-harvesting
  - phishing-pages
  - dom-analysis
  - ssl-certificates
  - visual-similarity
  - url-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1556"]
---

# Detecting Credential Harvesting Pages

## Overview

Credential harvesting pages impersonate legitimate login portals to steal user
credentials. This skill covers techniques for identifying these pages through
DOM analysis, form action inspection, SSL/TLS certificate examination, visual
similarity scoring, and automated classification. Detection feeds into takedown
workflows and threat intelligence sharing.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| `requests` | `pip install requests` |
| `beautifulsoup4` | `pip install beautifulsoup4` |
| `sslyze` | `pip install sslyze` |
| `curl` | HTTP inspection |
| `openssl` | Certificate analysis |

## Key Concepts

### Harvesting Page Indicators

| Indicator | Description |
|---|---|
| Form action to external domain | Login form POSTs to attacker server |
| Recently registered domain | Domain age < 30 days |
| Free TLS certificate | Let's Encrypt on impersonation domain |
| Hidden iframe overlay | Transparent layer capturing keystrokes |
| JavaScript credential exfiltration | `XMLHttpRequest` or `fetch` to external endpoint |
| URL path mimicry | `/login`, `/signin`, `/auth` on non-legitimate domain |
| Data URI favicon | Embedded favicon to avoid network requests |
| Password field without username persistence | No `autocomplete` or session handling |

### Common Harvesting Frameworks

```
Phishing Kits:
├── Evilginx2 — Reverse proxy MitM, captures session tokens + MFA
├── Gophish — Open-source phishing simulation (legitimate use)
├── Modlishka — Real-time 2FA interception proxy
├── EvilnoVNC — Browser-in-browser via VNC session
├── Muraena — Automated reverse proxy phisher
└── Custom PHP kits — Form POST to attacker-controlled endpoint
```

### Detection Signals

```
High Confidence:
├── Form action URL domain ≠ page domain
├── Page domain registered < 7 days ago
├── SSL cert issued < 48 hours ago
├── JavaScript sends credentials to third-party endpoint

Medium Confidence:
├── Visual similarity > 85% to known brand login
├── URL contains brand name but wrong TLD
├── Page lacks expected brand infrastructure (CDN, analytics)
└── robots.txt blocks all crawlers (hiding from scanners)
```

## Workflow

### 1. Safe Page Retrieval

```bash
# Always use sandboxed environment for live phishing pages
# Never open suspected phishing URLs in a production browser

# Fetch page source safely
curl -sL -A "Mozilla/5.0" -o /tmp/phish_page.html "https://suspect-url.com/login"

# Capture HTTP response headers
curl -sI -A "Mozilla/5.0" "https://suspect-url.com/login" > /tmp/phish_response.txt

# Screenshot with headless browser (sandboxed)
# chromium --headless --screenshot=/tmp/phish.png "https://suspect-url.com/login"
```

### 2. DOM Analysis

```bash
# Inspect form actions
grep -i '<form' /tmp/phish_page.html | grep -i 'action='

# Find credential exfiltration endpoints
grep -iE 'fetch\(|XMLHttpRequest|\.ajax\(' /tmp/phish_page.html

# Check for hidden iframes
grep -i '<iframe' /tmp/phish_page.html

# Look for obfuscated JavaScript
grep -iE 'eval\(|atob\(|fromCharCode|unescape\(' /tmp/phish_page.html

# Automated analysis
node agent.js analyze /tmp/phish_page.html
```

### 3. Certificate Analysis

```bash
# Inspect SSL certificate
openssl s_client -connect suspect-url.com:443 -servername suspect-url.com \
  < /dev/null 2>/dev/null | openssl x509 -noout -text

# Check certificate age
openssl s_client -connect suspect-url.com:443 -servername suspect-url.com \
  < /dev/null 2>/dev/null | openssl x509 -noout -dates

# Check certificate issuer (free certs are common on phishing)
openssl s_client -connect suspect-url.com:443 -servername suspect-url.com \
  < /dev/null 2>/dev/null | openssl x509 -noout -issuer
```

### 4. Domain Intelligence

```bash
# WHOIS registration date
whois suspect-url.com | grep -i 'creation\|registered'

# DNS records
dig A suspect-url.com
dig MX suspect-url.com
dig NS suspect-url.com

# Check domain against threat feeds
node agent.js check-domain suspect-url.com
```

## Detection

```yaml
title: Credential Harvesting Pages Detection
id: e2f470ab-b919-4298-ade0-03d1ecf8a5bc
status: experimental
description: Detects suspicious activity related to detecting credential harvesting pages techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1556
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| Form actions identified | All `<form>` elements inspected for external POSTs |
| JS exfiltration checked | `fetch`/`XMLHttpRequest` calls to external domains flagged |
| Certificate analyzed | Issuer, age, and SAN verified |
| Domain age checked | WHOIS creation date < 30 days flagged |
| Visual similarity scored | Compared against known brand login templates |
| IOCs extracted | URLs, IPs, domains collected for blocklisting |

## References

- [APWG eCrime Research](https://apwg.org/)
- [PhishTank](https://phishtank.org/)
- [OpenPhish](https://openphish.com/)
- [URLhaus](https://urlhaus.abuse.ch/)
- [Evilginx2 Documentation](https://github.com/kgretzky/evilginx2)
