Hi everybody.
This is just a really quick tutorial on something which I constantly see being posted about, in regards to questions.
Like I always mention: if something similar has already been posted apologies, I just want to help people out. Hope you enjoy the tutorial.
What actually is email spoofing?
Defenition: Email spoofing is the creation of email messages with a forged sender address
Essentially email spoofers are used to trick their victims into believing that the sender is somebody, who they are not. An example would be somebody sending an example to their victim, and claiming to be from Facebook for example.
How many people actually fall for it?
Possibly to your suprise - thousands and thousands of people fall for spoofed emails every single day depending on their look of legitimacy.
What is email spoofing used for?
Email spoofing can be used for tricking your victim into doing the following, but not limited to:
- Downloading your virus
- Visiting a website of your choice
- Informing somebody of false information
- Social Engineering
The power is as large as your mind of creativity. Email spoofing is a powerful ally if used well and manipulated correctly.
Getting Started..
PHP is a powerful scripting language used on web servers, and is a hypertext pre-processor.
It can be used to create a spoof email, and sent directly to your victim in the hope to trick them into whatever your dark mind desires. Here is the code for the PHP script:
This code works perfectly, however: mainstream email providers use spam detection scripts which will pick this up, and automatically move it to your victim's spam folder.
This is obviously a large issue, because let's be honest - who the hell checks their spam folder!?
So how can we avoid our email getting sent directly to the spam folder? We can use a web-based email spoofer which runs powerful scripts which ensures the spoofed email doesn't get sent to the spam folder.
Web-based Email Spoofer..
We can use a service called Mandrill, which enables us to avoid our emails from being sent directly to the victim's spam folder.
Link to their website: https://www.mandrill.com/
So firstly you want to create an account, as you would imagine:
![[Image: bkwGkgw.png]](https://i.imgur.com/bkwGkgw.png/)
Once you've logged in - go to the side bar on the left hand side, click the arrow next to "Outbound" and click "Compose Message"
![[Image: wLn7eYA.png]](https://i.imgur.com/wLn7eYA.png/)
Once you've done this you have the following fields:
- From Email: the email address you want it to appear it came from
- To Email: the email address you want the composed message to be delivered to
- Subject: the subject of your written composed message
- The big text box: this is where you write your composed message
![[Image: eygD8kH.png]](https://i.imgur.com/eygD8kH.png/)
Most important part...
Make your email look completely legit, and not some 2-minute put together piece of complete shit.
Tips for making the email look legitimate: use proper grammar and spelling, use the HTML interface, use layouts from previous emails for the people you're posing as and use common sense.
![[Image: xeWrO1b.png]](https://i.imgur.com/xeWrO1b.png/)
Finally - click send once your email is looking beautiful and all your information has been entered correctly. This will now go to the user's email, and you wait patiently.
Evidence:
![[Image: i9YvAfd.png]](https://i.imgur.com/i9YvAfd.png/)
![[Image: GSBIXYs.png]](https://i.imgur.com/GSBIXYs.png/)
Final Tips and Tricks...
When logged into Mandrill you can view the actual activity of the spoofed email that you've sent out. Such as if its been opened, if the victim has clicked any links, and so fourth.
To do this go onto the Main Menu, and click "Outbound" and scroll down.
![[Image: dRgAzrD.png]](https://i.imgur.com/dRgAzrD.png/)
Here you can see all this super useful information which can help you discover if your victims are falling for your tricks, or not.
![[Image: CKOVJqG.png]](https://i.imgur.com/CKOVJqG.png)
Thankyou for reading this tutorial and I hope it's helped you in the art of black hatting.
Feel free to ask any questions, leave constructive critism or say a thankyou.
This is just a really quick tutorial on something which I constantly see being posted about, in regards to questions.
Like I always mention: if something similar has already been posted apologies, I just want to help people out. Hope you enjoy the tutorial.
What actually is email spoofing?
Defenition: Email spoofing is the creation of email messages with a forged sender address
Essentially email spoofers are used to trick their victims into believing that the sender is somebody, who they are not. An example would be somebody sending an example to their victim, and claiming to be from Facebook for example.
How many people actually fall for it?
Possibly to your suprise - thousands and thousands of people fall for spoofed emails every single day depending on their look of legitimacy.
What is email spoofing used for?
Email spoofing can be used for tricking your victim into doing the following, but not limited to:
- Downloading your virus
- Visiting a website of your choice
- Informing somebody of false information
- Social Engineering
The power is as large as your mind of creativity. Email spoofing is a powerful ally if used well and manipulated correctly.
Getting Started..
PHP is a powerful scripting language used on web servers, and is a hypertext pre-processor.
It can be used to create a spoof email, and sent directly to your victim in the hope to trick them into whatever your dark mind desires. Here is the code for the PHP script:
PHP Code
<?php
$to = '[email protected]';
$from = '[email protected]';
$subject = 'The Subject Here';
$message = 'The Message Here';
$headers = "From: $from\r\n"
mail($to, $subject, $message, $headers)
?>This code works perfectly, however: mainstream email providers use spam detection scripts which will pick this up, and automatically move it to your victim's spam folder.
This is obviously a large issue, because let's be honest - who the hell checks their spam folder!?
So how can we avoid our email getting sent directly to the spam folder? We can use a web-based email spoofer which runs powerful scripts which ensures the spoofed email doesn't get sent to the spam folder.
Web-based Email Spoofer..
We can use a service called Mandrill, which enables us to avoid our emails from being sent directly to the victim's spam folder.
Link to their website: https://www.mandrill.com/
So firstly you want to create an account, as you would imagine:
Once you've logged in - go to the side bar on the left hand side, click the arrow next to "Outbound" and click "Compose Message"
Once you've done this you have the following fields:
- From Email: the email address you want it to appear it came from
- To Email: the email address you want the composed message to be delivered to
- Subject: the subject of your written composed message
- The big text box: this is where you write your composed message
Most important part...
Make your email look completely legit, and not some 2-minute put together piece of complete shit.
Tips for making the email look legitimate: use proper grammar and spelling, use the HTML interface, use layouts from previous emails for the people you're posing as and use common sense.
Finally - click send once your email is looking beautiful and all your information has been entered correctly. This will now go to the user's email, and you wait patiently.
Evidence:
Final Tips and Tricks...
When logged into Mandrill you can view the actual activity of the spoofed email that you've sent out. Such as if its been opened, if the victim has clicked any links, and so fourth.
To do this go onto the Main Menu, and click "Outbound" and scroll down.
Here you can see all this super useful information which can help you discover if your victims are falling for your tricks, or not.
Thankyou for reading this tutorial and I hope it's helped you in the art of black hatting.
Feel free to ask any questions, leave constructive critism or say a thankyou.
My list of Tutorials on Hack Forums: http://pastebin.com/2bRwGa7m
