[mrunlimited2]

Hey folks,

I’m working on a little lab project together with a friend (with full consent).
The idea: I send them a link, they click it, and the page then collects whatever information the browser is willing to share (OS, device type, browser, IP/geo, screen size, etc.).

I’m curious about two things:

Has anyone here built something similar?

What technical approach worked best for you?

Did you host it on Netlify, your own server, or use a webhook service?

Notification methods:

Would you recommend getting a mail notification when someone clicks the link?

Or is there a more convenient way (e.g. logging into a dashboard, using a webhook viewer, or even a push notification)?

I don’t have many details about my friend’s device upfront, so the point is to see what the browser/server combo can reveal by default, versus what needs explicit permission (like Geolocation API).

I’d love to hear from people who’ve tried this before: what worked, what didn’t, and what you’d recommend if the goal is mainly educational/fun and not production-level tracking.

Thanks! 🙌


In a parallel universe, would it be forbidden to ask about this in this forum if my friend theoretically hadn't agreed to the "prank"?

[DramaKing]

This exists. It's called BeEF. Many of the functions are blocked now, but you're mainly asking for things that are contained in a user agent, anyway. Don't know what Netlify is, but you'll have to host BeEF yourself. Don't know about a webhook like this.

And if your friend wasn't consenting, you could expect to receive "Why are you doing this to your friend?"

[Hackers]

in PHP you can just use $_SERVER vars to get IP, user agent, headers, referrer, etc

Very simple. You can also do the same thing many different ways

for example you can host an image and log it through your apache/nginx

You could send an image to them directly, and if you do it on a platform that doesn't auto-cache shared images (or bridge/mirror it) then you will capture their details from the request.

You just need to host the image, page, or whatever link somewhere that you can access either root (vps, vm, etc) or detailed logs easily.

[mrunlimited2]

thank you for your experienced answers.
now trying beEf.
is it possible to obfuscate the source to make it undetectable? like in the "other world" of crypters.

[Hackers]

thank you for your experienced answers.
now trying beEf.
is it possible to obfuscate the source to make it undetectable? like in the "other world" of crypters.

For networking methods, it's no different than just sending a normal link or photo. For example to get an IP, you only need to host a normal image, no code or anything - as long as you can access the server logs for the network request to that image.

If you are trying to get all possible client side, you don't need to obfuscate anything. Reading a user's IP, headers, referrer, user agent, etc is all normal & best practice for security and general web development. It's not suspicious for that data to be read, and it would be more suspicious to obfuscate or encrypt any of the frontend code for this purpose.

Your idea can be done without any special code.

[mrunlimited2]

For networking methods, it's no different than just sending a normal link or photo. For example to get an IP, you only need to host a normal image, no code or anything - as long as you can access the server logs for the network request to that image.

If you are trying to get all possible client side, you don't need to obfuscate anything. Reading a user's IP, headers, referrer, user agent, etc is all normal & best practice for security and general web development. It's not suspicious for that data to be read, and it would be more suspicious to obfuscate or encrypt any of the frontend code for this purpose.

Your idea can be done without any special code.

I was refering to this: "Many of the functions are blocked now", but I understand that an obfuscation will not make the functions revive. But the basic functions of beEF, the gathering still works? I will try some of the functions. Lets see. Thank you

[Mr. Node.js]

Hey folks,

I’m working on a little lab project together with a friend (with full consent).
The idea: I send them a link, they click it, and the page then collects whatever information the browser is willing to share (OS, device type, browser, IP/geo, screen size, etc.).

I’m curious about two things:

Has anyone here built something similar?

What technical approach worked best for you?

Did you host it on Netlify, your own server, or use a webhook service?

Notification methods:

Would you recommend getting a mail notification when someone clicks the link?

Or is there a more convenient way (e.g. logging into a dashboard, using a webhook viewer, or even a push notification)?

I don’t have many details about my friend’s device upfront, so the point is to see what the browser/server combo can reveal by default, versus what needs explicit permission (like Geolocation API).

I’d love to hear from people who’ve tried this before: what worked, what didn’t, and what you’d recommend if the goal is mainly educational/fun and not production-level tracking.

Thanks! 🙌


In a parallel universe, would it be forbidden to ask about this in this forum if my friend theoretically hadn't agreed to the "prank"?

It sounds like a fun, educational experiment if everything is done with full consent, like you mentioned. Browsers will give some default info like OS, browser type, screen size, and IP/geo, but anything more sensitive (like precise location) usually requires explicit permission.

I’ve worked on similar projects before and would even be happy to help out with this one if needed.

For technical setup:

• Hosting on your own server or a simple static host like Netlify works fine.
  




• Logging clicks via a dashboard or using a webhook viewer is usually more convenient than email notifications, especially if you want to track multiple clicks.
  

And yes—asking about this is totally fine as long as it’s ethical and everyone involved has agreed. Without consent, it would cross a legal and ethical line.

Good luck— 🙌