My organization wants to send out a test phishing email to all employees after a week of security awareness.

I plan on drafting a basic HTML page and including a misspelled link to it in an email with spoofed headers and intentionally incorrect email addresses to see if employees are wary enough to click or not.

I was also planning on embedding IP tracker URLs to track if employees actually clicked the links or not.

Is there a way I can track individual users who click links by attaching their email address to a list?

I originally was planning on using a basic free IP-logger online such as https://grabify.link/ or https://blasze.com/, but this will only track specific IPs and log them. I want to ideally track the number of times the link is clicked and, if possible, grab the email address the phishing email was sent to.

For example, if john@company.com clicked the link, it would tell me John clicked a link.

If alice@company.com clicked the link in my email, it would tell me that Alice opened my link.

Any ideas?

  • 4
    Aren't you essentially asking on how to have a link which is unique for each user, i.e. http://tracker.example.com/userid where userid could be some handle in a database, the (base64 encoded) email address or similar? – Steffen Ullrich Jun 4 '18 at 13:43
  • yes basically I would like to track which user clicked link – NULL.Dude Jun 4 '18 at 13:44
  • 2
    Given that the idea of such a link is trivial I imagine that you are more looking into some tracking infrastructure which supports such kind of links already - which essentially is asking for a product recommendation and thus off-topic. – Steffen Ullrich Jun 4 '18 at 13:46
  • 1
    Owner of Grabify here. Contact us via the website and we can set this us for you. – jLynx Nov 20 '18 at 1:30

You could generate a unique link per user like this:

http://server/?userid=[md5hash of username]

Next you can make the index.php at the webserver log all entries of userid. Or you could check webserver logs to see which userid's have tried to connect.

  • 4
    Hash means you don't need to maintain a username -> ID table. – Reinstate Monica Jun 4 '18 at 15:55
  • 1
    It's an example, there's no need. But it obfuscates the username, which is just proper practise. – Nomad Jun 4 '18 at 16:07
  • 1
    It makes it slightly harder to spoof someone else clicking the link. Might want to add some salt to that hash? – OJW Jun 4 '18 at 16:16
  • 1
    @OJW I left that out because it's still possible for a user to send the link incl. Salted hash to another user. The Salt would be advised if you want to hide the usernames from the logs in case anyone else ever finds them. But in that case I wouldn't go for md5 either. This is just an example that is easily traceable and readable without rainbow tables. Securing this data or verifying it's integrity is a whole different story, which depends on the setup :-) – Nomad Jun 4 '18 at 16:51
  • 1
    @Nomad Yes I agree. I understand the need of hashing, but in this example it seems like theres no reason too. – JBis Jun 4 '18 at 19:46

I would suggest creating DNS entries in your workplace network, for all the domains you want, resolving to computer hosting a PHP script that logs all information you need. This would all you to include domains that you don't actually own such as ggmail.com, faceboook.com, etc.

The PHP script could log users using @Nomad's method (or other ways), IP address, time, etc. You could also make each page have a login requesting their credentials to see if they will fall for that too.

  • None of this answer actually answers the question. You are just adding extra features to the test. – schroeder Jun 4 '18 at 19:33
  • @schroeder The question wasn't really clear. It appears that the OP was looking for ideas on how to use phishing links to log data. I was merely making a suggestion on how to incorporate what they want in there email. If this was on SO then I would have assumed they wanted a PHP script but this is not InfoSec so I provided this answer. – JBis Jun 4 '18 at 19:36
  • The question was "Is there a way I can track individual users who click links by attaching their email address to a list?" – schroeder Jun 4 '18 at 19:38
  • @schroeder I edited my comment. Although you are not entirely wrong I think the answer has merit even if it does not directly answer the question, as it assists with one aspect of the question "...track...users who click links...". If you disagree, feel free to flag as "not an answer". Sorry. – JBis Jun 4 '18 at 19:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.