Save Page WE website saver

Save Page WE is a chrome extension used by phishers to clone a target website and save it as a single HTML file.

Unlike HTTrack (another commonly used tool):

  • It's a browser extension so doesn't require any additional tools to be installed.
  • It saves pages as a single HTML file (with all assets embedded in it) which makes the resulting kit more portable and easier to deploy.

References

IOK Rule (edit) 

title: Save Page WE website saver
description: |
  Save Page WE is a chrome extension used by phishers to clone a target website and save it as a single HTML file.
  
  Unlike HTTrack (another commonly used tool):
  * It's a browser extension so doesn't require any additional tools to be installed.
  * It saves pages as a single HTML file (with all assets embedded in it) which makes the resulting kit more portable and easier to deploy.
references:
  - https://chrome.google.com/webstore/detail/save-page-we/dhhpefjklgkmgeafimnjhojgjamoafof
related:
  - id: httrack

detection:
  cssComment:
    html|contains: "/*savepage-url="

  metaComments:
    html|contains:
      - "<meta name=\"savepage-url\" content=\""
      - "<meta name=\"savepage-title\" content=\""
      - "<meta name=\"savepage-pubdate\" content=\""
      - "<meta name=\"savepage-from\" content=\""
      - "<meta name=\"savepage-date\" content=\""
      - "<meta name=\"savepage-state\" content=\""
      - "<meta name=\"savepage-version\" content=\""
      - "<meta name=\"savepage-comments\" content=\""
  condition: cssComment or metaComments

tags:
  - cloning