Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow PHP parameters in phishing URL #377

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

mcjon3z
Copy link

@mcjon3z mcjon3z commented Jan 24, 2018

In playing around with a sample campaign, I noticed that the UID is appended directly to the URL operating on the assumption that the URL is formatted as "hxxp://site.url.com/" which makes it not possible to include your own PHP parameters in the URL; if you do, the actual URL becomes "hxxp://site.url.com/?myparameter=1?uid=00000" instead of "hxxp://site.url.com/?myparameter=1&uid=00000"

This PR allows you to include your own parameters to be passed to the phishing page. For example I use a parameter on some pages that will imbed a meterpreter HTA file. The way it's set up now I either have to modify the template or manually modify the landing page to set the msf variable, instead of just being able to set it by doing something like "hxxp://site.url.com/?msf=1" to trigger it during the campaign setup.

@zeknox
Copy link
Member

zeknox commented Jan 24, 2018

Does this still work properly if the phishing_url has some folder depth with multiple slashes like below?

http://example.org/software/download/update.php

@mcjon3z
Copy link
Author

mcjon3z commented Jan 24, 2018

Yep. I am going to tweak that check because I just noticed that it is searching for "/?" instead of just "?" so it would not properly pick up a URL that was entered as "hxxp://site.com/index.php?parameter=1"

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants