Allow PHP parameters in phishing URL #377
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In playing around with a sample campaign, I noticed that the UID is appended directly to the URL operating on the assumption that the URL is formatted as "hxxp://site.url.com/" which makes it not possible to include your own PHP parameters in the URL; if you do, the actual URL becomes "hxxp://site.url.com/?myparameter=1?uid=00000" instead of "hxxp://site.url.com/?myparameter=1&uid=00000"
This PR allows you to include your own parameters to be passed to the phishing page. For example I use a parameter on some pages that will imbed a meterpreter HTA file. The way it's set up now I either have to modify the template or manually modify the landing page to set the msf variable, instead of just being able to set it by doing something like "hxxp://site.url.com/?msf=1" to trigger it during the campaign setup.