SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
analyzing-banking-trojan-webinjects
0
Analyzes banking trojan webinject configurations to extract targeted institutions, injected JavaScript/HTML, and data-theft hooks, mapping the fraud workflow. Activates for requests to analyze banking trojan webinjects, parse a webinject config, or map targeted banks and credential-theft injections.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Analyzing Banking Trojan Webinjects ## When to Use - You have a banking trojan webinject config (Zeus/Gozi/Dridex-style `set_url`/`data_before`/ `data_inject` blocks) and want to extract targeted institutions and injected code. - You are mapping the web-fraud workflow (form-grabbing, fake fields, MFA interception). **Do not use** this to deploy or test injects against live banking sites. This skill parses the config statically and executes nothing. ## Prerequisites - The decoded webinject config text (decrypt the config first if needed). ## Safety & Handling - Treat injected JS/HTML as malicious; do not render it. Defang any exfil URLs. ## Workflow ### Step 1: Parse webinject blocks ```bash python scripts/analyst.py parse webinjects.txt ``` Parses `set_url`/`data_before`/`data_inject`/`data_after` blocks into structured entries with the targeted URL pattern and the injected snippet. ### Step 2: Extract targets and exfil endpoints List targeted institution URL patterns and any exfil endpoints referenced by the injected code. ### Step 3: Classify the injection technique Identify form-grabbing, fake additional fields (SSN, PIN, card), and MFA/OTP interception from the injected markup/JS. ### Step 4: Defang and report Defang URLs and summarize targeted banks and theft techniques. ## Validation - Each webinject block is parsed into target URL + injection. - Exfil endpoints in injected code are extracted and defanged. - Injection techniques are classified from the snippet content. ## Pitfalls - Encrypted/packed configs needing decryption before parsing. - Wildcard URL patterns matching broadly — note the scope. - Obfuscated injected JS hiding the true exfil endpoint. ## References - See [`references/api-reference.md`](references/api-reference.md) for the parser. - ATT&CK T1185 and webinject format references (linked in frontmatter).