<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detecting Credential Harvesting Pages

## Agent Script

### Commands

| Command | Description |
|---|---|
| `node agent.js analyze <file>` | Analyze HTML for harvesting indicators |
| `node agent.js check-domain <domain>` | Check domain for suspicious signals |
| `node agent.js extract-forms <file>` | Extract form targets from HTML page |

### Examples

```bash
# Full page analysis with risk scoring
node agent.js analyze /tmp/phish_page.html

# Check a suspect domain
node agent.js check-domain login-micr0soft.xyz

# Extract all form POST targets
node agent.js extract-forms /tmp/phish_page.html
```

## Manual Inspection Commands

| Command | Purpose |
|---|---|
| `curl -sL -o page.html <url>` | Safe page retrieval |
| `curl -sI <url>` | Response header inspection |
| `openssl s_client -connect host:443` | Certificate inspection |
| `whois <domain>` | Domain registration age |
| `grep -i '<form' page.html` | Locate form elements |

## Detection Indicators

| Indicator | Severity |
|---|---|
| Form POSTs to external domain | Critical |
| JS sends credentials externally | Critical |
| Hidden iframe overlay | High |
| JavaScript obfuscation | High |
| Domain age < 7 days | High |
| Free TLS certificate | Medium |
| Brand name in unrelated domain | Medium |
| Suspicious TLD (.xyz, .tk, .top) | Medium |
