Jul 31, 2014 02:09 PM
(This post was last modified: Aug 1, 2014 03:34 AM by c x y k.)
Original thread located at https://hackforums.net/showthread.php?tid=4321958, posted by @Niely.
Hello there.
I've been reading through threads that request ip loggers and such, and stumbled upon Niely's post. I read it through and thought I was able to make it a little more detailed with some extended features. This is my first post, all feedback is welcome.
Things needed:
This is a very easy task, it's designed to be read through and examined, although you can just skid the post at the bottom.
The following will display a legitimate 404 Not Found page to a user, log their ip along with a timestamp in a JSON user-friendly .txt file (or .json, if you prefer that).
Getting Started
First, you need to either find an editor such as Notepad, or download an IDE such as http://brackets.io/. I won't go into details on how to install this, it's pretty self-explanatory, google is also your friend.
If you don't know how to open Notepad, you can either search for it on your computer, or open up Run (Windows Key + R), and type "Notepad.exe".
Once you've got that opened, we need to copy a very little bit of PHP code. This code will allow us to prettify the JSON.
Now that we've done this, we need to start writing the script itself. The above is to make the logs user-friendly and pretty.
Starting to write the script
Now we've got all the easy stuff done, let's continue with some more (easy?) scripting.
First off, we need to check if the log file exists. If it doesn't, we create it. Note: You can change the file extension to .json, if you wish.
Under your current code, and before the php closing tag ("?>"), paste/write this in:
After the php closing tag ("?>"), paste/write the following:
Explanation
clearstatcache() enables us to clear the file status cache, just to be on the safe side (incase the log file was removed/renamed).
After that function, we check if "log.txt" doesn't exist. If this is found to be true, we open the file which php creates, and then we close it.
The $json variable gets the contents of the file and decodes the json within it, the second parameter of json_decode() tells php to create an array out of it.
We unset the file to prevent memory leaks, in case the large JSON causes issues.
After doing that, we add on to the $json variable that's now an array. gmdate() allows us to get the current GMT timestamp, you can add onto GMT/remove hours from GMT by adding the following after time()
If you use the '-' symbol, the date created would be GMT-7 hours, using the '+' symbol would be GMT+7.
HTML Explanation
The rest of the code is pretty much HTML, although PHP echoes out two values.
We use HTML5 by declaring the DOCTYPE, we then open html by using <html>, closing it with </html>.
Within this, we set the title called "404 Not Found".
After doing this, we just print out the Apache 404 Not Found error message. We print two PHP variables that include the current file path and domain, although you can obviously change all of this.
Once we've done this, we should have the following code:
Spoiler (Click to View)
As you can see, it's very short, efficient and quite simple. If you need help with putting the above script onto a hosting provider and getting a domain, I recommend you read through https://hackforums.net/showthread.php?tid=4321958 and scroll down to "Now, our site is ready."
As said in the linked post, you can also use URL-Shorteners such as bitf.ly or goo.gl, thus allowing you to create a shortened version of the domain, and more 'legitimate' looking.
If you need any more information, I suggest reading through the end of the linked thread, it is helpful for novices.
I hope you enjoyed my tutorial, I will continue to create them/add onto others if I get good feedback. If you have any questions, feel free to reply. As I have a very low post count, I cannot reply to pm's.
Thanks!
Edit:
Here's an example of the "log.txt" file;
"***.***.***.***" would be the victim's ip.
Hello there.
I've been reading through threads that request ip loggers and such, and stumbled upon Niely's post. I read it through and thought I was able to make it a little more detailed with some extended features. This is my first post, all feedback is welcome.
Things needed:
- Very basic knowledge about HTML and PHP, but this is not needed.
- A webhost, such as SPAM.com (free).
- A domain name, or ip (less likely to look legitimate), free domains available at dot.tk.
- Basic text editor, although an IDE or such is better.
This is a very easy task, it's designed to be read through and examined, although you can just skid the post at the bottom.
The following will display a legitimate 404 Not Found page to a user, log their ip along with a timestamp in a JSON user-friendly .txt file (or .json, if you prefer that).
Getting Started
First, you need to either find an editor such as Notepad, or download an IDE such as http://brackets.io/. I won't go into details on how to install this, it's pretty self-explanatory, google is also your friend.
If you don't know how to open Notepad, you can either search for it on your computer, or open up Run (Windows Key + R), and type "Notepad.exe".
Once you've got that opened, we need to copy a very little bit of PHP code. This code will allow us to prettify the JSON.
PHP Code
<?php
function json_readable_encode($in, $indent = 0, $from_array = true) {
$_myself = __FUNCTION__;
$_escape = function ($str) {
return preg_replace("!([\b\t\n\r\f\"\\'])!", "\\\\\\1", $str);
};
$out = '';
foreach ($in as $key=>$value) {
$out .= str_repeat("\t", $indent + 1);
$out .= "\"".$_escape((string)$key)."\": ";
if (is_object($value) || is_array($value)) {
$out .= "\n";
$out .= $_myself($value, $indent + 1);
}
elseif (is_bool($value)) {
$out .= $value ? 'true' : 'false';
} elseif (is_null($value)) {
$out .= 'null';
} elseif (is_string($value)) {
$out .= "\"" . $_escape($value) ."\"";
} else {
$out .= $value;
}
$out .= ",\n";
}
if (!empty($out)) {
$out = substr($out, 0, -2);
}
$out = str_repeat("\t", $indent) . "{\n" . $out;
$out .= "\n" . str_repeat("\t", $indent) . "}";
return $out;
}
?>Now that we've done this, we need to start writing the script itself. The above is to make the logs user-friendly and pretty.
Starting to write the script
Now we've got all the easy stuff done, let's continue with some more (easy?) scripting.
First off, we need to check if the log file exists. If it doesn't, we create it. Note: You can change the file extension to .json, if you wish.
Under your current code, and before the php closing tag ("?>"), paste/write this in:
PHP Code
<?php
clearstatcache();
if(!file_exists("log.txt")) {
$fp = fopen("log.txt","w");
fclose($fp);
}
$file = file_get_contents("log.txt");
$json = json_decode($file, true);
unset($file);
$json[] = array(gmdate("d-m-Y H:i", time()) => $_SERVER['REMOTE_ADDR']);
file_put_contents('log.txt', json_readable_encode($json));
unset($json);
After the php closing tag ("?>"), paste/write the following:
PHP Code
<?php
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html>
<head>
<title>404 Not Found</title>
</head>
<body>
<h1>Not Found</h1>
<p>The requested URL <?=$_SERVER['PHP_SELF']?> was not found on this server.</p>
<p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p>
<hr/>
<address>Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 Server at <?=$_SERVER['SERVER_NAME']?> Port 80</address>
</body>
</html>
Explanation
PHP Code
<?php
clearstatcache();
if(!file_exists("log.txt")) {
$fp = fopen("log.txt","w");
fclose($fp);
}
clearstatcache() enables us to clear the file status cache, just to be on the safe side (incase the log file was removed/renamed).
After that function, we check if "log.txt" doesn't exist. If this is found to be true, we open the file which php creates, and then we close it.
PHP Code
<?php
$json = json_decode(file_get_contents("log.txt"), true);
$json[] = array(gmdate("d-m-Y H:i", time()) => $_SERVER['REMOTE_ADDR']);
file_put_contents('log.txt', json_readable_encode($json));
unset($json);
The $json variable gets the contents of the file and decodes the json within it, the second parameter of json_decode() tells php to create an array out of it.
We unset the file to prevent memory leaks, in case the large JSON causes issues.
After doing that, we add on to the $json variable that's now an array. gmdate() allows us to get the current GMT timestamp, you can add onto GMT/remove hours from GMT by adding the following after time()
PHP Code
<?php
-/+ 7*60*60
If you use the '-' symbol, the date created would be GMT-7 hours, using the '+' symbol would be GMT+7.
HTML Explanation
The rest of the code is pretty much HTML, although PHP echoes out two values.
We use HTML5 by declaring the DOCTYPE, we then open html by using <html>, closing it with </html>.
Within this, we set the title called "404 Not Found".
After doing this, we just print out the Apache 404 Not Found error message. We print two PHP variables that include the current file path and domain, although you can obviously change all of this.
Once we've done this, we should have the following code:
Spoiler (Click to View)
As you can see, it's very short, efficient and quite simple. If you need help with putting the above script onto a hosting provider and getting a domain, I recommend you read through https://hackforums.net/showthread.php?tid=4321958 and scroll down to "Now, our site is ready."
As said in the linked post, you can also use URL-Shorteners such as bitf.ly or goo.gl, thus allowing you to create a shortened version of the domain, and more 'legitimate' looking.
If you need any more information, I suggest reading through the end of the linked thread, it is helpful for novices.
I hope you enjoyed my tutorial, I will continue to create them/add onto others if I get good feedback. If you have any questions, feel free to reply. As I have a very low post count, I cannot reply to pm's.
Thanks!
Edit:
Here's an example of the "log.txt" file;
PHP Code
<?php
{
"0":
{
"31-07-2014 20:53": "***.***.***.***"
},
"1":
{
"31-07-2014 20:55": "***.***.***.***"
},
"2":
{
"31-07-2014 20:57": "***.***.***.***"
},
"3":
{
"31-07-2014 21:04": "***.***.***.***"
},
"4":
{
"31-07-2014 21:08": "***.***.***.***"
}
}
"***.***.***.***" would be the victim's ip.
