Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to create a phishing email for a project I am on. In the email I want to link to a site that will collect IP, browser, date/time of when visited. nothing malicious but to just prove that users clicked the link. Can I do this in social engineering toolkit or is it not possible?

share|improve this question
If your only problem is the collection of those informations, you could simply set up a webserver. Apache, for example, stores all of that without further configuration. – copy May 24 '13 at 18:03
up vote 1 down vote accepted

The simplest method is to put a user-custom token in each copy of the phishing email. For example, a Groupon mailing in my inbox has the following link - I've inserted a bunch of newlines between the individual fields of the URL-encoded string. You can see that there is a "user" field with a 64-byte hexadecimal string - that's the unique identifier that tells Groupon that it's me when I click on their email to look at the deal on their website.

So when I click to go to their site, they know I'm there because they sent a newsletter to (someone) via email on May 22nd. They assume (someone) is me, because of that user string; of course, if I forward the email to my friends, and they click, then the web site will get that user string from them... so this is only a loose connection. If you're phishing, however, it's really the closest you'll get without getting them to do more than just click on a link.

share|improve this answer

gowenfawr gave a concise answer however, I will go a step further here. Depending on what e-mail client the user has, you could force them to visit a site like it or not. It involves embedding a JPG or GIF, a server, and mod_security.

In the instance described above, you could embed say "logo.jpg" into your signature. IF the user has an email that allows for displaying remote content (html in the email), you can tell mod_security: "hey, whenever someone asks for logo.jpg, give them logo.swf" where logo.swf performs a getURL to open a browser.

SecFilterSelective REQUEST_URI "/logo.jpg" redirect:

Inside the swf file you could put whatever you want:

getURL("social-engineering-toolkit-page.html", "_blank", "GET");

All depends on how much time you want to spend, how much effort you put in, etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.