{"id":24641223,"url":"https://github.com/sammwyy/spearcopy","last_synced_at":"2025-07-24T21:34:58.510Z","repository":{"id":269613831,"uuid":"892124444","full_name":"sammwyy/SpearCopy","owner":"sammwyy","description":"A universal and local phishing toolkit for audit purposes","archived":false,"fork":false,"pushed_at":"2024-11-21T15:01:40.000Z","size":7,"stargazers_count":18,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-05-12T15:16:52.211Z","etag":null,"topics":["audit","pentest","pentest-tool","pentesting","phishing","phishing-kit","phishing-page","phishing-script","phishing-tool","python","web-clone","web-crawler","webscraping","website-clone","website-crawler"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sammwyy.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-11-21T14:52:51.000Z","updated_at":"2025-04-08T21:28:00.000Z","dependencies_parsed_at":"2024-12-24T20:36:56.032Z","dependency_job_id":"a40f8fe0-28a9-4f2c-a27c-dc3ea0d685f5","html_url":"https://github.com/sammwyy/SpearCopy","commit_stats":null,"previous_names":["sammwyy/spearcopy"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/sammwyy/SpearCopy","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sammwyy%2FSpearCopy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sammwyy%2FSpearCopy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sammwyy%2FSpearCopy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sammwyy%2FSpearCopy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sammwyy","download_url":"https://codeload.github.com/sammwyy/SpearCopy/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sammwyy%2FSpearCopy/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266905582,"owners_count":24004147,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-24T02:00:09.469Z","response_time":99,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["audit","pentest","pentest-tool","pentesting","phishing","phishing-kit","phishing-page","phishing-script","phishing-tool","python","web-clone","web-crawler","webscraping","website-clone","website-crawler"],"created_at":"2025-01-25T12:12:43.053Z","updated_at":"2025-07-24T21:34:58.472Z","avatar_url":"https://github.com/sammwyy.png","language":"Python","funding_links":["https://ko-fi.com/sammwy"],"categories":[],"sub_categories":[],"readme":"# 🕵️‍♂️ SpearCopy\r\n\r\n**SpearCopy** is an educational and auditing tool designed to clone websites locally and capture credentials entered into forms. It’s ideal for controlled environments such as internal network testing and does not require Internet access.\r\n\r\n\u003e **⚠️ Disclaimer:** This project is intended **only for educational purposes** and testing in controlled environments. **Misuse of this tool is strictly prohibited.** I am not responsible for any damage caused by improper use of this software.\r\n\r\n---\r\n\r\n## ✨ **Features**\r\n\r\n- **📋 Website cloning:** Downloads the full content of a webpage, including HTML, CSS, JavaScript, images, and other resources, preserving the original structure.\r\n- **🦝 Credential capture:** Modifies forms to capture and log entered data in JSON format.\r\n- **💻 Local HTTP server:** Hosts the cloned site locally for testing.\r\n- **💀 Customizable payload:** Includes an editable JavaScript payload to tailor phishing behavior.\r\n- **📚 Download management:** Avoids duplicate downloads and organizes resources in folders based on the target URL.\r\n\r\n---\r\n\r\n## 🛠️ **Requirements**\r\n\r\n- Python 3.9 or higher.\r\n- Dependencies listed in `requirements.txt` (install them with `pip install -r requirements.txt`).\r\n\r\n---\r\n\r\n## 🚀 **Usage**\r\n\r\n### **Main Commands**\r\n\r\n1. **Clone a website and start the server:**\r\n\r\n   ```bash\r\n   python main.py start \u003curl\u003e\r\n   ```\r\n\r\n   - Downloads the specified website into `tmp/\u003chash\u003e/public`.\r\n   - Starts a local HTTP server at `http://localhost:8080` to serve the cloned site.\r\n\r\n2. **Clean the temporary directory:**\r\n\r\n   ```bash\r\n   python main.py clean\r\n   ```\r\n\r\n   - Deletes all files and folders under the `tmp` directory.\r\n\r\n---\r\n\r\n## 📁 **File Structure**\r\n\r\n### **Generated Files**\r\n\r\nWhen running the `start` command, the cloned site is saved in the following structure:\r\n\r\n```python\r\ntmp/\r\n└── \u003chash_md5\u003e/\r\n    ├── public/        # Contains the cloned website.\r\n    │   ├── index.html # Main cloned page.\r\n    │   ├── css/       # Local or remote CSS files.\r\n    │   ├── js/        # Local or remote JavaScript files.\r\n    │   └── ...        # Other resources (images, videos, etc.).\r\n    └── logs/          # Folder for captured data logs.\r\n        └── \u003clog_id\u003e.json\r\n```\r\n\r\n### **Captured Data Logs**\r\n\r\nEach submitted form is logged as a JSON file in the `logs` folder. An example log looks like this:\r\n\r\n```json\r\n{\r\n   \"local_url\": \"http://evil.com/index.html\",\r\n   \"remote_url\": \"http://realwebsite.com/index.html\",\r\n   \"address\": \"192.168.0.10\",\r\n   \"userAgent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.94 Safari/537.36\",\r\n   \"data\": {\r\n      \"username\": \"test_user\",\r\n      \"password\": \"1234\"\r\n   }\r\n}\r\n```\r\n\r\n---\r\n\r\n## 📋 **Payload JavaScript**\r\n\r\nThe credential-capturing behavior is defined in the `capture.js` file. By default, it intercepts form submissions, prevents them from being sent, and logs the captured data via the `/capture` endpoint.\r\n\r\nYou can edit the `capture.js` file to customize the phishing behavior.\r\n\r\n---\r\n\r\n## 📢 **Example Usage**\r\n\r\n1. Run the command to clone a website:\r\n\r\n   ```bash\r\n   python main.py start https://example.com\r\n   ```\r\n\r\n   This will download the site and serve it at `http://localhost:8080`. All files will be stored in `tmp/\u003chash_md5\u003e/public`.\r\n\r\n2. Open the cloned site in a browser.\r\n\r\n3. Submit data into a form and check the console or the logs stored in `tmp/\u003chash_md5\u003e/logs`.\r\n\r\n4. To clean up temporary files:\r\n\r\n   ```bash\r\n   python main.py clean\r\n   ```\r\n\r\n---\r\n\r\n## 🤝 Contributing\r\n\r\nContributions, issues and feature requests are welcome! Feel free to check [issues page](https://github.com/sammwyy/spearcopy/issues).\r\n\r\n---\r\n\r\n## ❤️ Show your support\r\n\r\nGive a ⭐️ if this project helped you! Or buy me a coffeelatte 🙌 on [Ko-fi](https://ko-fi.com/sammwy)\r\n\r\n---\r\n\r\n## 📝 License\r\n\r\nCopyright © 2024 [Sammwy](https://github.com/sammwyy). This project is [MIT](LICENSE) licensed.\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsammwyy%2Fspearcopy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsammwyy%2Fspearcopy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsammwyy%2Fspearcopy/lists"}