Skip to content

giriaryan694-a11y/PhantomPath

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

ย 

History

21 Commits
LICENSE
LICENSE
ย 
ย 
README.md
README.md
ย 
ย 
index.html
index.html
ย 
ย 

Repository files navigation

โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•— โ–ˆโ–ˆโ•—  โ–ˆโ–ˆโ•— โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•— โ–ˆโ–ˆโ–ˆโ•—   โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•— โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•— โ–ˆโ–ˆโ–ˆโ•—   โ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•— โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•—  โ–ˆโ–ˆโ•—
โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•‘  โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ–ˆโ–ˆโ•—  โ–ˆโ–ˆโ•‘โ•šโ•โ•โ–ˆโ–ˆโ•”โ•โ•โ•โ–ˆโ–ˆโ•”โ•โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ–ˆโ–ˆโ•— โ–ˆโ–ˆโ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•—โ•šโ•โ•โ–ˆโ–ˆโ•”โ•โ•โ•โ–ˆโ–ˆโ•‘  โ–ˆโ–ˆโ•‘
โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•”โ–ˆโ–ˆโ•— โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•”โ–ˆโ–ˆโ–ˆโ–ˆโ•”โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•‘
โ–ˆโ–ˆโ•”โ•โ•โ•โ• โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•‘โ•šโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•‘โ•šโ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•”โ•โ•โ•โ• โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•‘
โ–ˆโ–ˆโ•‘     โ–ˆโ–ˆโ•‘  โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•‘  โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•‘ โ•šโ–ˆโ–ˆโ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘   โ•šโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ•‘ โ•šโ•โ• โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•‘     โ–ˆโ–ˆโ•‘  โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘   โ–ˆโ–ˆโ•‘  โ–ˆโ–ˆโ•‘
โ•šโ•โ•     โ•šโ•โ•  โ•šโ•โ•โ•šโ•โ•  โ•šโ•โ•โ•šโ•โ•  โ•šโ•โ•โ•โ•   โ•šโ•โ•    โ•šโ•โ•โ•โ•โ•โ• โ•šโ•โ•     โ•šโ•โ•โ•šโ•โ•     โ•šโ•โ•  โ•šโ•โ•   โ•šโ•โ•   โ•šโ•โ•  โ•šโ•โ•

Advanced URL Obfuscation Tool for Cybersecurity Research

Status Client-Side Techniques Companion License Research

Developed by Aryan Giri

๐ŸŒ Live Demo ยท ๐Ÿ›ก๏ธ Detection Tool ยท ๐Ÿ“– How It Works ยท ๐Ÿงช Local Testing ยท โš ๏ธ Disclaimer

๐Ÿ“„ Overview

PhantomPath is a client-side, browser-based utility that demonstrates the full spectrum of URL obfuscation techniques employed by real-world attackers in phishing campaigns, malware delivery, and social engineering attacks.

Understanding how a malicious destination can be structurally disguised is foundational to building robust defenses โ€” from training security analysts to evaluate suspicious links, to developing smarter detection rules in firewalls and email gateways.

Every transformation PhantomPath generates is functionally valid in modern browsers, yet visually deceptive to an untrained eye. All processing happens locally in your browser โ€” no data ever leaves your machine.

๐ŸŒ Live Tool

Try PhantomPath directly โ€” no install, no server, no tracking.

https://giriaryan694-a11y.github.io/PhantomPath/

โœจ Features

PhantomPath implements 9 distinct obfuscation techniques, each targeting a different layer of human perception or browser parsing behaviour.

๐ŸŽญ Credential Padding

Exploits the @ symbol in URL syntax to position a trusted decoy domain visually before the real destination. Browsers interpret everything before @ as credentials โ€” not a hostname.

https://google.com@192.168.1.1
         โ†‘ what victim reads    โ†‘ where browser actually goes

๐Ÿ”ข IPv4 โ†’ Hexadecimal

Converts dotted-decimal IPv4 into its 32-bit hex equivalent. Browsers silently resolve hex-encoded IPs, bypassing filters that scan for decimal IP patterns.

142.250.190.46  โ†’  http://0x8EFABE2E

๐Ÿ”ข IPv4 โ†’ Dword (32-bit Integer)

Transforms an IP address into a single unsigned 32-bit integer. Natively supported by browsers, unrecognisable to casual inspection.

142.250.190.46  โ†’  http://2398854702

๐Ÿ”ข IPv4 โ†’ Octal

Encodes each octet in octal (base-8) notation. Ancient but still browser-resolved.

142.250.190.46  โ†’  http://0216.0372.0276.0056

๐Ÿ”€ Mixed Encoding

Combines hex, decimal, and octal across the four octets to defeat most pattern-based scanners.

142.250.190.46  โ†’  http://0x8E.250.0276.46

๐Ÿ”ก Full URL Encoding

Percent-encodes every character into %HH ASCII hex. Turns any URL into percent signs and hex digits that bypass naive keyword matching.

google.com  โ†’  https://%67%6F%6F%67%6C%65%2E%63%6F%6D

๐Ÿ”  Character Substitution (Visual Trick)

Replaces characters with same-alphabet visual lookalikes โ€” all pure ASCII, typeable on any keyboard, yet indistinguishable from the real domain in common fonts.

PhantomPath generates every possible individual variant โ€” one substitution per result:

google.com  โ†’  g0ogle.com    (first o โ†’ 0)
               go0gle.com    (second o โ†’ 0)
               googIe.com    (l โ†’ I)
               google.c0m    (o in TLD โ†’ 0)
               g009le.com    (g โ†’ 9)
               googl3.com    (e โ†’ 3)  ... and more

Complete substitution map (27 pairs):

Category Substitutions
Letter โ†’ Number lโ†’I, lโ†’1, iโ†’1, oโ†’0, eโ†’3, aโ†’4, sโ†’5, bโ†’6, tโ†’7, zโ†’2, gโ†’9
Number โ†’ Letter 0โ†’o
Digraph (2โ†’1 char) rnโ†’m, nnโ†’m, clโ†’d, vvโ†’w, iiโ†’n, liโ†’h, riโ†’n, lIโ†’H
Reverse Digraph (1โ†’2 chars) mโ†’rn, mโ†’nn, dโ†’cl, wโ†’vv
Case swap sโ†’S, oโ†’O, Iโ†’l

๐ŸŒ Combo Squatting

The attacker registers a domain containing the brand name combined with a trust-triggering keyword. Victim reads a familiar word and assumes legitimacy โ€” but the entire domain is attacker-controlled.

Real:    google.com

Fakes:   google-security.com       google-login.com
         google-verify.com         secure-google.com
         googlesupport.com         google.com.secure.com
         google.net                google.io
         ... 150+ variants generated

5 pattern types:

Pattern Example
brand-keyword.tld paypal-security.com
keyword-brand.tld secure-paypal.com
brandkeyword.tld paypallogin.com
Level squatting paypal.com.verify.com
TLD variation paypal.net, paypal.io, paypal.xyz

Most-abused keywords in real campaigns: support, security, login, verify, account, update, payment, recover.

๐Ÿ”ค IDN Homograph Attack

Replaces Latin characters with visually identical Unicode (Cyrillic) lookalikes, then converts to punycode xn-- โ€” the actual DNS-resolvable address.

Target spoof:    google.com
Unicode fake:    gะพะพglะต.com          โ† what victim copies & sees
Real DNS form:   xn--gle-7cdaaa.com  โ† what you register & host

Spoofable characters: a โ†’ ะฐ c โ†’ ั e โ†’ ะต o โ†’ ะพ p โ†’ ั€ x โ†’ ั… y โ†’ ัƒ

๐Ÿ–ฅ๏ธ Interface

  • 9 method badges โ€” click to switch techniques; only relevant fields appear
  • Protocol toggle โ€” choose HTTP or HTTPS for every technique
  • Multi-variant output โ€” Char Substitution and Combo Squatting show every variant as scrollable, clickable rows
  • Research popup โ€” auto-displays local testing guide on first use; "Do not show again" stored in cookie
  • One-click copy โ€” copies the URL or last-clicked variant instantly
  • Dark / Light theme โ€” toggle with persistent cookie preference
  • 100% client-side โ€” zero server calls, zero telemetry

๐Ÿ”ฌ How It Works

Technique Layer Exploited
Credential Padding Browser URL parser โ€” user@host syntax
Hex / Dword / Octal Legacy numeral base support in IP resolution (RFC 3986)
Mixed Encoding Per-octet mixed numeral system tolerance
URL Encoding %HH transparently decoded before DNS lookup
Char Substitution Human visual perception โ€” same-alphabet lookalikes
Combo Squatting Human pattern recognition โ€” brand anchoring
IDN Homograph Unicode โ†’ punycode conversion (IDNA 2008 / RFC 5891)

๐Ÿงช Local Testing Guide

All three domain-based techniques can be fully demonstrated without purchasing a domain by mapping the generated domain to your local machine.

๐Ÿ”  Char Substitution & ๐ŸŒ Combo Squatting

These generate standard ASCII domains (e.g. googIe.com, google-security.com). Add them to your hosts file and serve a page on localhost.

Linux / macOS

sudo nano /etc/hosts
# Add:
127.0.0.1    googIe.com
127.0.0.1    google-security.com
# Save with Ctrl+X, then start a local server:
python3 -m http.server 80

Windows (open Notepad as Administrator)

C:\Windows\System32\drivers\etc\hosts
# Add:
127.0.0.1    googIe.com
127.0.0.1    google-security.com
# Flush DNS:
ipconfig /flushdns

Check if a combo-squatted domain is already registered:

# Linux/macOS:
whois google-security.com

# Windows:
nslookup google-security.com
# NXDOMAIN = available to register

๐Ÿ”ค IDN Homograph

The generated xn-- punycode domain must be mapped โ€” browsers resolve the Unicode display version to its punycode form automatically.

Linux / macOS

sudo nano /etc/hosts
# Add (use your actual generated xn-- domain):
127.0.0.1    xn--gle-7cdaaa.com
# Serve:
python3 -m http.server 80

Windows (Notepad as Administrator)

C:\Windows\System32\drivers\etc\hosts
127.0.0.1    xn--gle-7cdaaa.com
# Flush:
ipconfig /flushdns

Local Network (Pi-hole / dnsmasq) โ€” resolves for all LAN devices:

address=/xn--gle-7cdaaa.com/192.168.1.100

Real-world case: In 2017, researcher Xudong Zheng registered xn--80ak6aa92e.com which displayed as apple.com in Chrome and Firefox. Both browsers were patched โ€” modern browsers now show punycode if all/mixed Cyrillic is detected.

๐Ÿงช Educational Use Cases

๐Ÿ›ก๏ธ Security Awareness Training

Show non-technical users how a URL reading "google.com" silently redirects to an attacker's server. Ideal for corporate phishing simulation and awareness workshops.

๐Ÿ”Ž SOC Analyst Skill Building

Train analysts to recognise obfuscated IOCs in proxy logs, email headers, and SIEM alerts โ€” hex IPs, dword addresses, xn-- domains, and combo-squatted URLs appear regularly in real C2 infrastructure.

๐Ÿงฑ WAF & Filter Evasion Research

Test whether your WAF, email gateway, or DNS filter catches alternate IP representations, character-substituted domains, and combo-squatted variants before an attacker finds the gap.

๐Ÿ”ด Red Team & Phishing Simulation

Generate realistic phishing infrastructure candidates for authorised red team engagements and simulation platforms.

๐Ÿ“š Academic / CTF

A live, reproducible reference covering techniques in OWASP, CEH, OSCP, and academic cybersecurity curricula.

๐Ÿ›ก๏ธ Mitigation & Detection โ€” ARYPHISH_DETECTOR

PhantomPath shows you how attacks are crafted. ARYPHISH_DETECTOR shows you how to catch them.

๐Ÿ”— github.com/giriaryan694-a11y/ARYPHISH_DETECTOR

ARYPHISH_DETECTOR is a multi-engine AI phishing detection tool โ€” also built by Aryan Giri โ€” that analyzes URLs for domain spoofing, combo-squatting, typosquatting, and phishing signals. It combines static domain analysis, live WHOIS lookups, DuckDuckGo search intelligence, and parallel AI verdict generation โ€” all through a sleek terminal-styled web UI.

Unlike static blocklist tools, ARYPHISH_DETECTOR fetches and analyzes the live page in real time, giving AI models full context: HTML source, domain registration data, and web search intelligence โ€” all in one enriched prompt.

How it detects

  • Combo-squatted & typosquatted domains โ€” catches google-security.com, paypa1.com style fakes
  • IDN homograph lookalikes โ€” detects xn-- punycode domains spoofing real brands
  • Obfuscated URLs โ€” hex IPs, dword addresses, percent-encoded destinations
  • Deceptive login forms โ€” credential harvesting page structure analysis
  • Urgency/threatening language โ€” social engineering signal detection
  • WHOIS anomalies โ€” newly registered domains, privacy-masked registrants
  • Search intelligence โ€” DuckDuckGo cross-reference to verify domain legitimacy

The red team / blue team loop

PhantomPath  (offensive)            ARYPHISH_DETECTOR  (defensive)
โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€    โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€
Generate:  google-security.com  โ†’   Verdict: PHISHING
           xn--gle-7cdaaa.com       Reason:  IDN homograph, newly registered,
           googIe.com                        fake login form detected
           %67%6F%6F%67%6C%65.com   Source:  Gemini + ChatGPT parallel verdict

Use both tools together for a complete offensive + defensive research loop โ€” generate the full attack surface with PhantomPath, then validate your detection coverage with ARYPHISH_DETECTOR.

Tech stack

Python ยท Flask ยท httpx ยท Google Gemini API ยท OpenAI ChatGPT API ยท WHOIS ยท DuckDuckGo Search ยท Tailwind CSS

๐Ÿ—‚๏ธ Project Structure

PhantomPath/
โ”œโ”€โ”€ index.html        # Entire tool โ€” single self-contained file
โ””โ”€โ”€ README.md         # This document

No build step. No dependencies. No frameworks.

๐Ÿ”’ Privacy & Security

  • Zero network requests โ€” all logic runs in-browser JavaScript
  • No analytics, no tracking โ€” cookies only for UI preferences (theme, popup state)
  • No input data stored or transmitted
  • Safe on air-gapped or restricted lab networks

โš ๏ธ Ethical Disclaimer

For Educational and Security Research Purposes Only.

PhantomPath was created to help students, researchers, and security professionals understand URL obfuscation techniques used in phishing, malware, and social engineering attacks.

The creator does not support or encourage use of this tool for phishing, deception, unauthorised access, or any illegal activity.

๐ŸŒ International Laws

Misuse of these techniques against real users or systems without explicit written authorisation is illegal worldwide. Key legislation includes:

Jurisdiction Law Relevant Provisions
USA Computer Fraud and Abuse Act (CFAA) Unauthorised access, fraud via computer
UK Computer Misuse Act 1990 Unauthorised access with intent to commit offences
EU Directive on Attacks Against Information Systems Illegal interception, system interference

๐Ÿ‡ฎ๐Ÿ‡ณ Indian Laws

India has specific and strict provisions covering all techniques demonstrated in this tool:

Information Technology Act, 2000 (IT Act) โ€” as amended by IT (Amendment) Act, 2008

Section Offence Punishment
Section 43 Unauthorised access to computer systems, downloading data, introducing malware Compensation up to โ‚น1 crore (civil liability)
Section 66 Computer-related offences โ€” hacking, data theft Imprisonment up to 3 years and/or fine up to โ‚น5 lakh
Section 66C Identity theft โ€” fraudulently using electronic signature, password, or unique identification Imprisonment up to 3 years + fine up to โ‚น1 lakh
Section 66D Cheating by impersonation using computer resources (directly covers phishing & spoofed URLs) Imprisonment up to 3 years + fine up to โ‚น1 lakh
Section 70 Unauthorised access to protected systems (government / critical infrastructure) Imprisonment up to 10 years

Indian Penal Code (IPC) / Bharatiya Nyaya Sanhita (BNS), 2023

Section (IPC / BNS) Offence Punishment
Section 419 IPC / Section 319 BNS Cheating by impersonation Imprisonment up to 3 years and/or fine
Section 420 IPC / Section 318 BNS Cheating and dishonestly inducing delivery of property (financial phishing) Imprisonment up to 7 years + fine
Section 468 IPC / Section 336 BNS Forgery for purpose of cheating Imprisonment up to 7 years + fine

Key point for Indian users: Section 66D IT Act specifically criminalises "cheating by personation by using computer resource" โ€” this directly covers creating phishing pages using spoofed URLs, combo-squatted domains, or homograph lookalikes targeting Indian users or entities. Complaints can be filed with the Cyber Crime Cell (cybercrime.gov.in) or local police under the IT Act.

๐Ÿ‘ค Author

Aryan Giri

Project Description
PhantomPath URL obfuscation research tool (this repo)
ARYPHISH_DETECTOR Multi-engine AI phishing detection โ€” Gemini + ChatGPT + WHOIS + DuckDuckGo

PhantomPath โ€” know the attack to build the defence.

About

PhantomPath is a client-side utility designed to demonstrate various techniques used to structurally obfuscate URLs. In the field of cybersecurity, understanding how an attacker can mask a malicious destination is crucial for developing robust defense mechanisms and training users in link analysis.

giriaryan694-a11y.github.io/PhantomPath/

Topics

cybersecurity educational web-security offensive-security red-team threat-analysis link-analysis social-engineering security-research client-side-security security-awareness browser-security frontend-security phishing-detection training-tool malicious-links javascript-security cyber-awareness url-analysis url-obfuscation

Resources

Readme

License

MIT license
Activity

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

No releases published

Packages

 
 
 

Contributors

Languages