mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.1 KiB
2.1 KiB
API Reference: Typosquatting Detection with dnstwist
dnstwist CLI
Syntax
dnstwist example.com # Basic scan
dnstwist -r example.com # Resolve DNS
dnstwist -r -f json example.com # JSON output
dnstwist -r -f csv example.com # CSV output
dnstwist -r --ssdeep example.com # Fuzzy hashing comparison
dnstwist -r --phash example.com # Perceptual hash (screenshot)
dnstwist -r -w wordlist.txt example.com # Dictionary-based
dnstwist --nameservers 8.8.8.8 example.com # Custom DNS
Fuzzing Techniques
| Technique | Description |
|---|---|
| Addition | Append character: examplea.com |
| Bitsquatting | Bit-flip: dxample.com |
| Homoglyph | Lookalike chars: examp1e.com |
| Hyphenation | Insert hyphen: exam-ple.com |
| Insertion | Insert char: exaample.com |
| Omission | Remove char: examle.com |
| Repetition | Double char: exxample.com |
| Replacement | Keyboard neighbor: rxample.com |
| Subdomain | Insert dot: ex.ample.com |
| Transposition | Swap chars: exmaple.com |
| Vowel-swap | Replace vowel: exomple.com |
Output Fields
| Field | Description |
|---|---|
fuzzer |
Technique used |
domain |
Permuted domain |
dns_a |
A record IP addresses |
dns_aaaa |
AAAA record addresses |
dns_mx |
Mail server records |
dns_ns |
Nameserver records |
geoip |
GeoIP country |
whois_registrar |
Domain registrar |
ssdeep_score |
Fuzzy hash similarity (0-100) |
Python Integration
Installation
pip install dnstwist
CLI via subprocess
import subprocess, json
result = subprocess.run(
["dnstwist", "-r", "-f", "json", "example.com"],
capture_output=True, text=True)
domains = json.loads(result.stdout)
for d in domains:
if d.get("dns_a"):
print(f"{d['domain']} -> {d['dns_a']}")
WHOIS Lookup
import whois
w = whois.whois("suspicious-domain.com")
print(w.creation_date, w.registrar)
VirusTotal Domain Check
curl -H "x-apikey: KEY" \
"https://www.virustotal.com/api/v3/domains/<domain>"