Releases: copyleftdev/whatthediff
Release list
v1.11.1 — Credential-form flag
wtd v1.11.1 — the credential-form flag
WhatTheDiff now flags credential-harvesting web pages on their own — no clustering required. Point it at captured pages (or fetch them with wtd web) and any page whose form collects a password or ≥2 sensitive fields is called out, with off-domain posting marked as an exfiltration signal.
This closes the gap wtd kit leaves: kit signatures need a family (≥2 deployments of the same kit), so one-off phishing harvesters on throwaway domains slip past. The credential-form flag catches each of them, per page.
$ wtd web https://lure.example/signin # or: wtd ./captured-pages
Credential forms (1 page harvesting credentials)
https://lure.example/signin
harvests: password, username posts to: collect.attacker.example ⚠ OFF-DOMAINWhat's new
- Per-page credential-form detection. A page is flagged when its form collects a password (by input type, so obfuscated names like
pw/pare still caught) or ≥2 distinct sensitive fields — username, card, cvv, ssn, otp, and seed / mnemonic / recovery for wallet phishing. - Off-domain exfiltration signal. When the page origin is known (via
wtd web), a form posting to a host other than its own is marked⚠ OFF-DOMAIN. - Surfaced everywhere it's useful:
- a Credential forms section in the report (silent on non-web corpora and benign pages — a search box or a lone newsletter email never flag),
- a
credential_forms[]array in--json, - the un-clustered harvesters appended to
wtd kit— the ones its family signatures structurally miss, - a new
--fail-on credential-formsCI gate for brand monitoring: fail the moment a watched page sprouts a login form posting off-domain.
Fixed in 1.11.1
- v1.11.0 keyed detection off the field name, so a password input with an obfuscated name (
name=pw) was missed — exactly what real phishing uses. The HTML extractor now surfaces the password type regardless of name, so the signal survives obfuscation. (Caught by a post-release smoke test.)
Proven on live phishing
Validated against a live OpenPhish feed, headless-rendered so JS-injected forms appear: the flag caught credential harvesters that wtd kit alone missed — including a multi-brand webmail kit collecting AOL / Office 365 / Outlook / Yahoo passwords — all as standalone pages, exactly the one-offs that never cluster into a family.
Install
# Linux / macOS / Git Bash — detects OS/arch, verifies SHA256
curl -fsSL https://raw.githubusercontent.com/copyleftdev/whatthediff/main/install.sh | sh
# Windows PowerShell
irm https://raw.githubusercontent.com/copyleftdev/whatthediff/main/install.ps1 | iexOr download a static binary below and verify it against SHA256SUMS:
sha256sum -c SHA256SUMSZero dependencies · one static ~300 KB binary · Linux (x86_64 / aarch64, fully static musl), macOS (Intel / Apple Silicon), Windows (x86_64 / aarch64) · Zig 0.14 · 109 tests, byte-deterministic output.
Docs: https://copyleftdev.github.io/whatthediff/ · Full diff: v1.10.0...v1.11.1