phishing-frenzy
phishing-frenzy copied to clipboard
Allow PHP parameters in phishing URL
In playing around with a sample campaign, I noticed that the UID is appended directly to the URL operating on the assumption that the URL is formatted as "hxxp://site.url.com/" which makes it not possible to include your own PHP parameters in the URL; if you do, the actual URL becomes "hxxp://site.url.com/?myparameter=1?uid=00000" instead of "hxxp://site.url.com/?myparameter=1&uid=00000"
This PR allows you to include your own parameters to be passed to the phishing page. For example I use a parameter on some pages that will imbed a meterpreter HTA file. The way it's set up now I either have to modify the template or manually modify the landing page to set the msf variable, instead of just being able to set it by doing something like "hxxp://site.url.com/?msf=1" to trigger it during the campaign setup.
Does this still work properly if the phishing_url has some folder depth with multiple slashes like below?
http://example.org/software/download/update.php
Yep. I am going to tweak that check because I just noticed that it is searching for "/?" instead of just "?" so it would not properly pick up a URL that was entered as "hxxp://site.com/index.php?parameter=1"