Phishing Site Scanner & Token Extractor
Budget: $30 – $250 USD
I need a lightweight, self-contained solution that does two things.
First, it must scan phishing sites for the full range of high-impact weaknesses: SQL Injection, Cross-Site Scripting (XSS), Remote Code Execution, insecure or unexpected HTTP requests, and any exposed files that should never be publicly reachable. A clear, human-readable report for each target URL is essential; I should be able to hand it to a non-technical stakeholder and have the findings understood at a glance. Feel free to leverage industry staples such as Python, Go, or off-the-shelf modules (e.g., OWASP-ZAP or Nmap scripts) as long as the final tool runs from a single command and needs minimal setup.
Second, I need a Telegram token extractor that works on both Windows and Linux hosts. Point it at a user profile or pass a path, and it should reliably pull the session token(s) so they can be archived or invalidated. A straightforward CLI output is perfect; no GUI required.
Deliverables
• Source code with concise README covering build & usage
• Example scan report demonstrating every vulnerability class above
• Executables (or build scripts) for Windows and Linux for the token extractor
Everything will be validated on fresh virtual machines: the scanner must flag deliberately vulnerable test pages, and the extractor must recover tokens from standard Telegram Desktop installs on each platform.
First, it must scan phishing sites for the full range of high-impact weaknesses: SQL Injection, Cross-Site Scripting (XSS), Remote Code Execution, insecure or unexpected HTTP requests, and any exposed files that should never be publicly reachable. A clear, human-readable report for each target URL is essential; I should be able to hand it to a non-technical stakeholder and have the findings understood at a glance. Feel free to leverage industry staples such as Python, Go, or off-the-shelf modules (e.g., OWASP-ZAP or Nmap scripts) as long as the final tool runs from a single command and needs minimal setup.
Second, I need a Telegram token extractor that works on both Windows and Linux hosts. Point it at a user profile or pass a path, and it should reliably pull the session token(s) so they can be archived or invalidated. A straightforward CLI output is perfect; no GUI required.
Deliverables
• Source code with concise README covering build & usage
• Example scan report demonstrating every vulnerability class above
• Executables (or build scripts) for Windows and Linux for the token extractor
Everything will be validated on fresh virtual machines: the scanner must flag deliberately vulnerable test pages, and the extractor must recover tokens from standard Telegram Desktop installs on each platform.