[Dasemu]

Well, the idea is to get the password of a big amount of employees of a company that iknow, i found a way that would be useful to trick them. This company website was done with an old website template they found on the internet and they forgot to delete "enviaramigo.asp" file on their server / directory, if you browse to website.com/enviaramigo.asp you will see a form with in wich you fill the data and write a message to someone, then, the website will trigger some backend stuff that will send an email to the person you specified in the form with the message you specified so it can be used for social-engineering by sending them a fake link. I also found that website is XSS vulnerable so i can inject code in the login.asp page by adding code at the end of URL. Now im looking for a way to aproach this vulnerability without exposing my IP, i thinked i could use NGROK or LocalTunnel but im not sure those are safe to use for this purpose, also i thinked to use BeeF over tor but it works realy slow so many times it doesnt even connect to the vps running BeeF so i dont get the password. Do you have any idea of how doing this?