Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am trying to create a phishing email for a project I am on. In the email I want to link to a site that will collect IP, browser, date/time of when visited. nothing malicious but to just prove that users clicked the link. Can I do this in social engineering toolkit or is it not possible?

share|improve this question
3  
If your only problem is the collection of those informations, you could simply set up a webserver. Apache, for example, stores all of that without further configuration. –  copy May 24 '13 at 18:03

2 Answers 2

up vote 1 down vote accepted

The simplest method is to put a user-custom token in each copy of the phishing email. For example, a Groupon mailing in my inbox has the following link - I've inserted a bunch of newlines between the individual fields of the URL-encoded string. You can see that there is a "user" field with a 64-byte hexadecimal string - that's the unique identifier that tells Groupon that it's me when I click on their email to look at the deal on their website.

http://www.groupon.com/deals/jimmy-s-famous-pizza-and-golfland-usa?
p=1
&utm_source=newsletter
&utm_medium=email
&sid=3cc714b9-fd5b-4d66-bead-e7c2e20d21bd
&division=boston
&user=03c1384e250d6c131d9b8948b6c5d536d26d9b0beb33f1fa5b6191e323b87c63
&date=20130522

So when I click to go to their site, they know I'm there because they sent a newsletter to (someone) via email on May 22nd. They assume (someone) is me, because of that user string; of course, if I forward the email to my friends, and they click, then the web site will get that user string from them... so this is only a loose connection. If you're phishing, however, it's really the closest you'll get without getting them to do more than just click on a link.

share|improve this answer

gowenfawr gave a concise answer however, I will go a step further here. Depending on what e-mail client the user has, you could force them to visit a site like it or not. It involves embedding a JPG or GIF, a server, and mod_security.

In the instance described above, you could embed say "logo.jpg" into your signature. IF the user has an email that allows for displaying remote content (html in the email), you can tell mod_security: "hey, whenever someone asks for logo.jpg, give them logo.swf" where logo.swf performs a getURL to open a browser.

SecFilterSelective REQUEST_URI "/logo.jpg" redirect:http://loaded-web-site.com/logo.swf

Inside the swf file you could put whatever you want:

getURL("social-engineering-toolkit-page.html", "_blank", "GET");

All depends on how much time you want to spend, how much effort you put in, etc.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.