Contact forms.
Need I say more before Twitter and other social media applications and their widespread use, there
were contact forms.
And now people choose to tweet directly to the company or organization or whatever it is.
So, yeah, I'm being a little glib, I realize that there are contact forms still in use, widespread
actually in different Web applications.
And it's possible to use the emailing system behind such a form.
All right, so in this lesson, we are going to try such a scenario.
So I want you to open Caleigh and it's always a law going to be web.
Over the mail, heter injection.
Now, due to an overused protocol, the name can change, so for this one, you can use the same TP
mail header injection as well.
Anyway, it is a simple contact form.
At least you can think it is.
All right, so let's view this source to control for anything suspicious.
Well, there's nothing to see here.
So first, I want to show you the configuration here.
So view settings dot BHP.
So here's my SMTP configuration, I'll just change it to these values.
Because a few times I've gotten some errors, but this works fine.
OK, so now let's give you the male injection page.
And it validates the email address that you enter for medium level as well as high.
Then set the e-mail server.
So then if the level is set to high, it uses another function called mail check to.
Then it creates the male body and sends it off.
So male check two is in this file, and I'm going to find it.
Well, that didn't take long.
Here it is.
So it decodes the date and then uses a built in function to validate the email.
OK, so go back to Firefox's.
Enable Foxe proxy.
Fill in the form.
I'm going to use this email address.
And then send.
So Berp will capture the request for us.
And here is the data.
And then at the back end, the server will use this email address as the sender, Zewail.
And it will send the email to be Web recipient at mail later dot com.
And we can send the request to the repeater for using later.
And then let it go.
So now go to the Web recipient's inbox and mail Nader dotcom.
And here's the email.
And this is all the email information subject and from headers are very important to us.
Actually, we can modify.
Only from the header for metadata, that's OK.
So go back to Berp and let's open the repeater tab.
I'm going to inject some male headers into this request, so type percent sign zero, a, C, C, call
in other inbox at WIRB mail dot com.
And the percent zero A.
And that's the carriage return character, by the way.
And then send it.
And we get a response, so as you can see, the mail is sent, so now it's go to chrome and open WIRB
mail dotcom.
And in another inbox.
Here's the email, so look at the headers.
So this inbox is present in the header.
OK, so go back to burb.
So these kinds of vulnerable forms can be used to spread fishing males and just all kinds of dreadful
stuff.
So now we can do a quick example, you can create a phishing email body by yourself.
But for me, I'm going to use some templates that I happen to have found on GitHub, so when Firefox
and go to this address.
Now, if you scroll down, you're going to see the templates.
There are different email templates here and.
OK, so I'm going to choose basic full plan looks like this.
Now, I think it's a simple and convincing template.
Yeah, so download it.
And it's in the downloads folder, so extract the files.
Now go to the template code under this directory and open the HTML document with a text editor.
Copy the source and go back to burb.
Open the decoder tab.
Pasted here.
And from the menu on the right to choose your URL and code, then.
Copy the encoded output.
Go back to the repeater tab.
Delete this part.
And at another return, character.
Then add the message header.
Pace the output here.
Then, Sam.
So the response came back, so that means there's no problem.
So now go to the recipient's address and click to have a look.
Now, I didn't add access code and I didn't want to make something else, but I can always make it pretty
and convincing if you want to use it.
Also, you can copy the e-mail format your customer uses and use that.
I know people who can even click the link in this email, so people still do.
So with a little bit of effort, you will spread a really good fishing e-mail and you'll have lots of
friends.