search

pentestgeek / phishing-frenzy

Ruby on Rails Phishing Framework
www.phishingfrenzy.com
GNU General Public License v3.0
770 stars 293 forks source link

Allow PHP parameters in phishing URL #377

Open mcjon3z opened 6 years ago

mcjon3z commented 6 years ago

In playing around with a sample campaign, I noticed that the UID is appended directly to the URL operating on the assumption that the URL is formatted as "hxxp://site.url.com/" which makes it not possible to include your own PHP parameters in the URL; if you do, the actual URL becomes "hxxp://site.url.com/?myparameter=1?uid=00000" instead of "hxxp://site.url.com/?myparameter=1&uid=00000"

This PR allows you to include your own parameters to be passed to the phishing page. For example I use a parameter on some pages that will imbed a meterpreter HTA file. The way it's set up now I either have to modify the template or manually modify the landing page to set the msf variable, instead of just being able to set it by doing something like "hxxp://site.url.com/?msf=1" to trigger it during the campaign setup.

zeknox commented 6 years ago

Does this still work properly if the phishing_url has some folder depth with multiple slashes like below?

http://example.org/software/download/update.php

mcjon3z commented 6 years ago

Yep. I am going to tweak that check because I just noticed that it is searching for "/?" instead of just "?" so it would not properly pick up a URL that was entered as "hxxp://site.com/index.php?parameter=1"

image