# AIS3 網頁安全 Final Project

## Topic
pass

## Possible Password Combination
### Element:
- Chinese Name (English Name)
- 朱元均 (Gino)
- 于子緯 (uier)
- Id
- Nickname
- Facebook id
- IG id
- Email username
- Birth
- 西元
- 民國
- 月日
- 農曆

- 身分證字號
- 電話
- 分機號碼
- 手機
- 地名
-
- 郵遞區號

{
    ChineseLastName,
    ChineseFirstName,
    EnglishLastName,
    EnglishFirstName,
    Id,
    BirthYear,
    BirthMinguoYear,
    BirthMonth,
    BirthDate,
    Telephone,
    TelephoneExt,
    Cellphone,
}

## To Do List
- [x] 中文 to 英數
- [x] 中文 to 注音
- [x] 倉頡
- [x] 西元轉農曆
- [x] OSINT
- [x] Combination
- [x] Front-End
- [x] Backend-End
## Reference
- [Have I been pwned](https://haveibeenpwned.com/Passwords)
- [一組只有台灣能理解的怪異密碼　「ji32k7au4a83」讓外國資安工程師好困惑](https://www.upmedia.mg/news_info.php?SerialNo=58781)

## OSINT
Steps:
1. a person enters his/her name
2. search for the person's blog name (medium, github.io)
3. search for the person's facebook, IG, twitter username
4. search for the person's images and locate new websites
5. search for the person's email and phone number

- find which website url has a username: https://github.com/sherlock-project/sherlock
- find which website has a username: https://github.com/HA71/Namechk
- test if your email has been pwned & if a password can login to multiple sites: https://github.com/D4Vinci/Cr3dOv3r

cd Cr3dOv3r 
python3 Cr3d0v3r.py [e-mail]

- most updated haveibeenpwned:
- https://github.com/wKovacs64/pwned
- https://github.com/thewhiteh4t/pwnedOrNot
- find instagram info
- https://github.com/sc1341/InstagramOSINT
- need to fix this before using: https://github.com/sc1341/InstagramOSINT/issues/12

cd InstagramOSINT
python3 main.py --username tinaaaaalee

- find email from github id
- https://github.com/s0md3v/Zen
- `python Zen/zen.py stevenyu113228`
- https://github.com/paulirish/github-email
- `github-email tina1998612`
- get info of facebook, twitter, and IG given username
- https://github.com/bhavsec/reconspider
- search fb ig and github domain using chinese name
- https://github.com/jgor/dork-cli
- `python3 dork-cli.py -m 1 -e 007157844896791691775:hglcszitvha -k AIzaSyCZFZ-aQkeddX7_eU46hEe1csWYJwD0hsg 游照臨`
- 李婷婷
- 鄧仁豐
- get a list of websites given username
- https://github.com/WebBreacher/WhatsMyName
- a collection of all osint websites..
- https://osintframework.com/

2020-08-01 08:25:12.434859,[e-mail],f7be44851027cdcc0f0ce8b5fe5421d3bf367d1c
2020-08-01 08:50:07.336926,[e-mail],9e1f69ae55f72f353e83d03f9f8f7e0a23d9abf4
2020-08-01 08:51:56.851463,[e-mail],ad3a4c388ab633f9bbbfc9ac6f164f8819552ead
2020-08-01 08:51:57.615539,[e-mail],73bc41ac0400558e92b572c38567d8a466e8afa4
2020-08-01 08:52:02.938015,[e-mail],e19acb93ba4a15f9ae1dec1f07daa62a9fa4b2a2
2020-08-01 08:54:06.819041,[e-mail],6d0070d3141313dcc3153021c29434f5fedbf465
2020-08-01 09:00:06.335188,[e-mail],581f48841115abc46ff8973602a4e642f8070712
2020-08-01 09:01:04.705670,[e-mail],9f0d1519e9934d88448b6c859f53860c7213ac9c
2020-08-01 09:02:53.980097,[e-mail],0d040f238b1055a8eec49babf6880da400acc76d
2020-08-01 09:07:39.463184,[e-mail],0f796d14c95a8111cfeae9aa266e4eb540e6b965
2020-08-01 09:24:56.141294,[e-mail],65c3d7806912acee4312305b6314cae0ad8b0d66
2020-08-01 09:54:56.589417,[e-mail],eabe7f7a14bc5da30a1a34021f5f40ae4bc7f5c5
2020-08-01 10:35:31.894346,[e-mail],9e1b00696d0bbb03a739e437075b3bffce13cbb8
2020-08-01 10:35:48.157446,[e-mail],1ec09083ff76d9601ea49513c81441c27a1adac0
2020-08-01 10:35:54.974739,[e-mail],33869e68904dc73285adabd332def9b8b4de68e9
2020-08-01 10:38:42.463493,[e-mail],72f3005b435226469c1af97f0c10a45f1896a47e
2020-08-01 10:56:58.965858,[e-mail],4c1d99ab9d4f183e821d04923dcee12f07888293
2020-08-01 11:06:30.245760,[e-mail],de546a2cbc2c746f7a6212830d9d375c6a0288b7
2020-08-01 11:24:42.182360,[e-mail],5d5fab3bba689a02f1889aaea028307b7b27c3ce
2020-08-01 11:24:53.449102,[e-mail],beabded99b1dffb8d00c52ecd021cf20598ece5c
2020-08-01 11:28:48.870341,[e-mail],115ad6d09078f5e005c5809dd5efd4ea6c7bf633
2020-08-01 11:29:53.315858,[e-mail],e77e979be9b339bdbdbee2bc47775d9ab5be5dda

[e-mail],希望下次可以有更多技巧課程~~
[e-mail],希望可以更多實作課
[e-mail],"期末可以改成解題或KOH嗎QQ，比較好玩~
課程的比例上有點不平均，平均分配的話，不論對於專題或是分組學習上才會比較公平點。

"
[e-mail],七天的活動我覺得辦得很不錯，網路環境、工作人員表現都很棒。不過關於課程的部分，我認為分辨真假訊息方面的課程太多了，導致學員們重複聽了好幾次一樣的東西，到最後一堂時幾乎沒有人在認真聽。但是我認為這是課程編排的問題，實際上每一堂課的品質還是都很好的。
[e-mail],"上課的內容有補充了不少基礎知識，不過應該大部分人都比較想聽技術類的課程吧XD！？
唯一比較累的是做專題有點趕，而且禮拜四五大家都在忙專題，發現很少人有在聽課，可能以後可以修正一下"
[e-mail],"今年感覺三堂國家安全的課的內容重複性很高，希望能稍微錯開
其他部分感覺都很棒，也學到很多東西(不過好累
希望明年能打的到final CTF ~~ ^^

"
[e-mail],第一次參加這個活動，感謝ais3讓我有這個機會學到許多東西，身為關鍵基礎設施的組別也覺得特別受到重視。
[e-mail],感謝ais3主辦單位的用心安排，比起往年課程安排上多了很多實務方面課程，身為關鍵基礎設施組也明顯感受到備受關注，包含課程安排以及資源投注，不過在CIS專題方面規模有些難以呈現，在時間安排上也多占用到上課時間無法專心覺得有點可惜。另外早餐代訂怎麼只有一天 XD AIS3 food panda 別做一半RRRRRRR 還有宵夜不錯，不愧是新型態資安食物主題課程😋

<!-- ## Topic
- Phishing wargame: An educational website that contains a list of phishing attacks. See if you are an expert in phising by solving all the challenges :P

## Types
- Password Phishing
- Create a clone of the website with similar url, for example, 123.com -> 123.org, thisisasite.com -> thissasite.com
- Use fake security alerts to let user click on the phishing site. For example, "your account has been hacked, please change your pwd"
- Solution: 2FA, U2F(Universal 2 Factor, physical usb login key): [Google Advanced Security Program](https://landing.google.com/advancedprotection/), FB, Twitter
- To bypass 2FA, hacker can set up app specific passwords which originally are used to support non-2FA devices & doing account migration after login
- [reference](https://www.amnesty.org/en/latest/research/2018/12/when-best-practice-is-not-good-enough/)
- OAuth
- Auth with Google, Github..., and direct to a fake login page
- URL Trick
- Google amp redirect
- `https://google.com/amp/meow-meow.tk`
- Email phishing
- Fake domain, malicious links (URL Tricks)
- Tricky Links
- Fake `a` tag
- `<a href="http://meow-meow.tk">http://www.google.com/</a>`
- Click Hijack
- Shorten URL
- bit.ly , reurl.cc
- 流行ㄉ社會議題
- 武漢肺炎、三倍券

##

## Reference
- [Guide-to-phishing](https://github.com/securitywithoutborders/guide-to-phishing)
- [google phishing quiz](https://phishingquiz.withgoogle.com)
- [url-analysis](https://mlhale.github.io/nebraska-gencyber-modules/phishing/url-analysis/)
- [Spot the Phish](https://www.sophos.com/en-us/lp/games/play-spot-the-phish.aspx?cmp=35375)
- [Phishing Quiz](https://www.opendns.com/phishing-quiz/) -->