Feb 4, 2015 11:55 AM
(This post was last modified: Feb 21, 2015 09:54 AM by Yoshikage Kira.)
In this tutorial i'll teach you how to steal files through windows shortcuts.
First let me tell you how it works:
When you select a shortcut to upload, it gives you the file the shortcut points to. Thus you can steal any file you want by making them select the shortcut when uploading a file, the problem with this is most file uploaders show the file name that's being uploaded, but don't worry! I provide a solution to bypass this.
Things you'll need:
After you create your free website, create a new database.
![[Image: 6yaaYuL.png]](https://i.imgur.com/6yaaYuL.png)
Then go to config.php and edit it with the details:
![[Image: odJNpLY.png]](https://i.imgur.com/odJNpLY.png)
Next install file manager and delete default.php, then upload the stealer files.
![[Image: nIeiFQc.png]](https://i.imgur.com/nIeiFQc.png)
Then go to phpmyadmin & import database.sql:
![[Image: YLqZ8He.png]](https://i.imgur.com/YLqZ8He.png)
MAKE SURE TO CHANGE THE DEFAULT CREDENTIALS
Next go to http://website/stolen.php where website is your website & login with your credentials(default is greed@:perfect123 in user:pass format).
Now add an id & descriptor for the id:
![[Image: QRnQHWM.jpg]](https://i.imgur.com/QRnQHWM.jpg)
I added the id 1234 with the descriptor "Greed's secret file".
![[Image: afOX6gR.png]](https://i.imgur.com/afOX6gR.png)
Now we'll create the shortcut:
Let's suppose you want to steal the file C:\code\credentials.txt:
![[Image: igjMEIb.png]](https://i.imgur.com/igjMEIb.png)
Then you'll create the folder code in C:\ & create the file credentials.txt.
Then you'll right click and do new->shortcut:
![[Image: o8Hzaqs.png]](https://i.imgur.com/o8Hzaqs.png)
Then you'll input C:\code\credentials.txt
![[Image: c3IGOn5.png]](https://i.imgur.com/c3IGOn5.png)
Hit next & name it whatever you want:
![[Image: bLUcWx0.png]](https://i.imgur.com/bLUcWx0.png)
Then click finish.
Next go to http://website/stealer.php?id=1234 to make sure it's working properly. If it appears all right:
![[Image: r82us5X.jpg]](https://i.imgur.com/r82us5X.jpg)
then you send them the shortcut & have them upload it to your website:
![[Image: HF9b7bh.png]](https://i.imgur.com/HF9b7bh.png)
Please be aware that relative paths don't work(ex: %AppData% or %Temp%), thus if you want to steal their Google Chrome cookies file you'll need to get their username on their computer and input the absolute path.
First let me tell you how it works:
When you select a shortcut to upload, it gives you the file the shortcut points to. Thus you can steal any file you want by making them select the shortcut when uploading a file, the problem with this is most file uploaders show the file name that's being uploaded, but don't worry! I provide a solution to bypass this.
Things you'll need:
After you create your free website, create a new database.
![[Image: 6yaaYuL.png]](https://i.imgur.com/6yaaYuL.png)
Then go to config.php and edit it with the details:
![[Image: odJNpLY.png]](https://i.imgur.com/odJNpLY.png)
Next install file manager and delete default.php, then upload the stealer files.
![[Image: nIeiFQc.png]](https://i.imgur.com/nIeiFQc.png)
Then go to phpmyadmin & import database.sql:
![[Image: YLqZ8He.png]](https://i.imgur.com/YLqZ8He.png)
MAKE SURE TO CHANGE THE DEFAULT CREDENTIALS
Next go to http://website/stolen.php where website is your website & login with your credentials(default is greed@:perfect123 in user:pass format).
Now add an id & descriptor for the id:
![[Image: QRnQHWM.jpg]](https://i.imgur.com/QRnQHWM.jpg)
I added the id 1234 with the descriptor "Greed's secret file".
![[Image: afOX6gR.png]](https://i.imgur.com/afOX6gR.png)
Now we'll create the shortcut:
Let's suppose you want to steal the file C:\code\credentials.txt:
![[Image: igjMEIb.png]](https://i.imgur.com/igjMEIb.png)
Then you'll create the folder code in C:\ & create the file credentials.txt.
Then you'll right click and do new->shortcut:
![[Image: o8Hzaqs.png]](https://i.imgur.com/o8Hzaqs.png)
Then you'll input C:\code\credentials.txt
![[Image: c3IGOn5.png]](https://i.imgur.com/c3IGOn5.png)
Hit next & name it whatever you want:
![[Image: bLUcWx0.png]](https://i.imgur.com/bLUcWx0.png)
Then click finish.
Next go to http://website/stealer.php?id=1234 to make sure it's working properly. If it appears all right:
![[Image: r82us5X.jpg]](https://i.imgur.com/r82us5X.jpg)
then you send them the shortcut & have them upload it to your website:
![[Image: HF9b7bh.png]](https://i.imgur.com/HF9b7bh.png)
Please be aware that relative paths don't work(ex: %AppData% or %Temp%), thus if you want to steal their Google Chrome cookies file you'll need to get their username on their computer and input the absolute path.



