1

a follow up question to this: Tracking click-through for organization-wide phishing email test

I am going to send an email (fake phish) to all my org. users via email. I want to test the users so if they click a malicious(fake) link their email address will be sent to a list (or I receive a notification saying user X click your test link) domain name will get logged/added to a list somewhere I can grab.

Method to capture the email address of users who clicked my link in a email.

closed as off-topic by Steffen Ullrich, Conor Mancone, AndrolGenhald, Xander, forest Jun 7 '18 at 5:16

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Conor Mancone, AndrolGenhald, Xander, forest
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    I'm voting to close this question as off-topic. This is not really a follow-up to a previous question which was closed as off-topic but it basically is the same off-topic question again. – Steffen Ullrich Jun 6 '18 at 17:15
  • the other question was closed as it was presumed to be asking for a product recommendation, but if they're actually asking about how to capture the requests from a technical standpoint, is that off-topic? – Angelo Schilling Jun 6 '18 at 17:32
  • 1
    @AngeloSchilling: If the OP thinks that the question was considered off-topic since it was interpreted the wrong way he should edit the question and requests that it gets reopened instead of basically asking the same question again. As you can see at the different view of the question the (partly overlapping) comments and answers here and on the previous question show, it does not seem to be really clear what the OP is actually asking. But instead of making it more clear the OP asks the same unclear question again. – Steffen Ullrich Jun 6 '18 at 18:14
  • 1
    Also flagging to close, but mainly just because this question has nothing to do with security. It is basically asking "how do I make a link to track users?" for which there are a million answers, none of which have to do with security. – Conor Mancone Jun 6 '18 at 19:24
  • 1
    Also, someone clicking a link doesn't mean that they fell for a phishing site. I commonly click links from phishing emails (after stripping out any information that may allow them to track my email address) mainly to see how serious the phishing campaign appears to be. – Conor Mancone Jun 6 '18 at 19:25
1

Two options

  1. Include the email address in the URL (host a server at example.com/phish?email=jon@example.com, that server extracts the url parameters, and writes to a file)

  2. Include the link in the email with a tracking ID (example.com/?trackid=1234), and store the tracking id in a database with all of the metadata.

Bottom line, you need a unique URL, and a way to capture that URL and map it back to the user (or the user and the email).

5

Use a link like phish.org?email=user@domain.com.

You can use base64 or any other encoding to obfuscate the email address, but the principle is the same.

  • can you expand on this? – NULL.Dude Jun 6 '18 at 17:11
  • 2
    Create a mail for each user, with a link unique to the user. If any link is clicked you know who clicked. – ThoriumBR Jun 6 '18 at 18:13
1

If you are asking if can you somehow query via the browser itself, then no.

The standard way to accomplish this is to include a unique ID for each user as part of the link, so when you see/parse the requests in your server logs, you can then identify which user the GET request came from.

You can do it with a php page, but you can also do it via a netcat loop(or any webserver listening for GET requests).

So for example:


email address | uid

email_a@example.com | 19243856

email_b@example.com | 54928490


on server: while true; do nc -lvp 4444 | grep GET >> results.txt; done

in email: http://malicious.example.co:4444/phish?id=19243856

in results.txt: GET /phish?id=19243856

You could automate an entire phishing campaign in a single (not very long) bash script, if you wanted, with a couple for loops and a file with the list of email addresses. :P

1

You should probably look into a framework, like Go Phishing that let's you design a campaign, see click trough rates, and individual users who clicked, and users who entered credentials.

This will do the heavy lifting, and make analytics a lot easier for you. There's absolutely no reason to reinvent the wheel, when there's a product for what you're trying to do already available.

(I am not affiliated with Go Phishing in any way, and the product is FLOSS)

Not the answer you're looking for? Browse other questions tagged or ask your own question.