# Ditto | A Tool For IDN Homograph Attacks And Detection

**URL:** <https://onehack.st/t/ditto-a-tool-for-idn-homograph-attacks-and-detection/172238>\
**Category:** Tools & Scripts\
**Tags:** tools, programming\
**Created:** [February 9, 2021, 10:46am UTC](https://onehack.st/t/ditto-a-tool-for-idn-homograph-attacks-and-detection/172238 "2021-02-09T10:46:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shayla](https://onehack.st/user_avatar/onehack.st/shayla/32/174870_2.png) [@Shayla](https://onehack.st/u/Shayla)\
**Post date:** [February 9, 2021, 10:46am UTC](https://onehack.st/t/ditto-a-tool-for-idn-homograph-attacks-and-detection/172238/1 "2021-02-09T10:46:11Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/d/1/d13a86f86f5c14f51408fc34cd89648002fc862f.png)

Ditto is a small tool that accepts a domain name as input and generates all its variants for an [homograph attack](https://en.wikipedia.org/wiki/IDN_homograph_attack) as output, checking which ones are available and which are already registered.

PoC domains

- [https://tᴡitter.com/](https://xn--titter-345b.com/)
- [https://clᴏudflare.com](https://xn--cludflare-6x3d.com/)

**Using with Docker**

The [image on docker hub](https://hub.docker.com/r/evilsocket/ditto) is updated on every push, you can just:

```auto
docker run evilsocket/ditto -h

```

**Compiling from sources**

Compiling from sources requires the go compiler, this will install the binary in `$GOPATH/bin`:

```auto
# make sure go modules are used
GO111MODULE=on go get github.com/evilsocket/ditto/cmd/ditto

```

**Usage**

To only transform a string:

```auto
ditto -string google

```

For a domain:

```auto
ditto -domain facebook.com

```

Use more concurrent workers to increase speed (WARNING: might cause a temporary IP ban from the WHOIS servers):

```auto
ditto -workers 4 -domain facebook.com

```

If instead of mutating the domain name you want to check other TLDs (throttle is set to 1s in order to avoid being blocked by WHOIS servers due to the many requests in a short timeframe):

```auto
ditto -domain facebook.com -tld -throttle 1000 -limit 100

```

Only show available domains:

```auto
ditto -domain facebook.com -available

```

Only show registered domains:

```auto
ditto -domain facebook.com -registered

```

Only show registered domains that resolve to an IP:

```auto
ditto -domain facebook.com -live

```

Show WHOIS information:

```auto
ditto -domain facebook.com -live -whois

```

Save to CSV file with extended WHOIS information:

```auto
ditto -domain facebook.com -whois -csv output.csv

```

Keep running and monitoring for changes every hour:

```auto
ditto -domain facebook.com -monitor 1h

```

The same but also keep and store the changes as JSON files:

```auto
ditto -domain facebook.com -monitor 1h -changes /some/path -keep-changes

```

Execute a command if changes have been detected (see example send-email-report.sh in this repo, automatically added to the docker image):

```auto
  ditto -domain facebook.com 
          -monitor 1h 
          -trigger "/usr/bin/send-email-report.sh {{.Domain}} {{.ChangesFile}} your@email.com"

```

For more options:

```auto
ditto -help

```

## GitHub:

> **[GitHub - evilsocket/ditto: A tool for IDN homograph attacks and detection.](https://github.com/evilsocket/ditto)**
>
> A tool for IDN homograph attacks and detection.