@@ -27,6 +27,43 @@ $: ./sepunycoder.py
2727👀 Translated text: https://раураl.соm/lоgin
2828` ` `
2929
30+ # 🎯 Proof of Concept - Demonstration
31+
32+ ! [proof_of_concept.png](proof_of_concept.png)
33+
34+ - Code Snippet
35+
36+ ` ` ` bash
37+ # From Punycode String (IDNA) to ASCII
38+ $: echo -n ' https://раураl.соm/lоgin' | idn -a
39+ xn--https://l-7yha4qb5b.xn--m/lgin-vqfdw
40+
41+ # From Punycode String (IDNA/ASCII) to Unicode
42+ $: echo -n ' xn--https://l-7yha4qb5b.xn--m/lgin-vqfdw' | idn -u
43+ https://раураl.соm/lоgin
44+
45+ # When DNS try to resolve the host (Punycode String)
46+ $: curl -I -X GET https://раураl.соm/lоgin
47+ curl: (6) Could not resolve host: xn--l-7sba6dbr.xn--m-0tbi
48+ ` ` `
49+
50+ + Useful Documentation: [https://www.icann.org/resources/pages/idn-2012-02-25-en](https://www.icann.org/resources/pages/idn-2012-02-25-en)
51+ + Note: ` idn` command is from [Libidn](https://www.gnu.org/software/libidn/)
52+
53+ # 🤺 Utility in Social Engineering
54+
55+ > " Punycode is a way to represent Unicode with the limited character subset of ASCII supported by the Domain Name System (DNS)" .
56+
57+ Therefore this tool can be used for Social Engineering Attacks in the following scenarios:
58+
59+ - Email Spoofing: Crafting email addresses that closely mimic those of trusted individuals or organizations using Punycode.
60+
61+ - Fake Website Creation: Register domain names containing Punycode characters to replicate well-known websites.
62+
63+ - Social Media Impersonation: Creation of Social Media profiles that impersonate genuine individuals or organizations.
64+
65+ - Phishing campaigns: Generate phishing links with Punycode-encoded domain names so that victim click on seemingly authentic links.
66+
3067# # ⚠️ DISCLAIMER
3168
3269This repository is intended for educational purposes only.
0 commit comments