‫Contact forms.
‫Need I say more before Twitter and other social media applications and their widespread use, there
‫were contact forms.
‫And now people choose to tweet directly to the company or organization or whatever it is.
‫So, yeah, I'm being a little glib, I realize that there are contact forms still in use, widespread
‫actually in different Web applications.
‫And it's possible to use the emailing system behind such a form.
‫All right, so in this lesson, we are going to try such a scenario.
‫So I want you to open Caleigh and it's always a law going to be web.
‫Over the mail, heter injection.
‫Now, due to an overused protocol, the name can change, so for this one, you can use the same TP
‫mail header injection as well.
‫Anyway, it is a simple contact form.
‫At least you can think it is.
‫All right, so let's view this source to control for anything suspicious.
‫Well, there's nothing to see here.
‫So first, I want to show you the configuration here.
‫So view settings dot BHP.
‫So here's my SMTP configuration, I'll just change it to these values.
‫Because a few times I've gotten some errors, but this works fine.
‫OK, so now let's give you the male injection page.
‫And it validates the email address that you enter for medium level as well as high.
‫Then set the e-mail server.
‫So then if the level is set to high, it uses another function called mail check to.
‫Then it creates the male body and sends it off.
‫So male check two is in this file, and I'm going to find it.
‫Well, that didn't take long.
‫Here it is.
‫So it decodes the date and then uses a built in function to validate the email.
‫OK, so go back to Firefox's.
‫Enable Foxe proxy.
‫Fill in the form.
‫I'm going to use this email address.
‫And then send.
‫So Berp will capture the request for us.
‫And here is the data.
‫And then at the back end, the server will use this email address as the sender, Zewail.
‫And it will send the email to be Web recipient at mail later dot com.
‫And we can send the request to the repeater for using later.
‫And then let it go.
‫So now go to the Web recipient's inbox and mail Nader dotcom.
‫And here's the email.
‫And this is all the email information subject and from headers are very important to us.
‫Actually, we can modify.
‫Only from the header for metadata, that's OK.
‫So go back to Berp and let's open the repeater tab.
‫I'm going to inject some male headers into this request, so type percent sign zero, a, C, C, call
‫in other inbox at WIRB mail dot com.
‫And the percent zero A.
‫And that's the carriage return character, by the way.
‫And then send it.
‫And we get a response, so as you can see, the mail is sent, so now it's go to chrome and open WIRB
‫mail dotcom.
‫And in another inbox.
‫Here's the email, so look at the headers.
‫So this inbox is present in the header.
‫OK, so go back to burb.
‫So these kinds of vulnerable forms can be used to spread fishing males and just all kinds of dreadful
‫stuff.
‫So now we can do a quick example, you can create a phishing email body by yourself.
‫But for me, I'm going to use some templates that I happen to have found on GitHub, so when Firefox
‫and go to this address.
‫Now, if you scroll down, you're going to see the templates.
‫There are different email templates here and.
‫OK, so I'm going to choose basic full plan looks like this.
‫Now, I think it's a simple and convincing template.
‫Yeah, so download it.
‫And it's in the downloads folder, so extract the files.
‫Now go to the template code under this directory and open the HTML document with a text editor.
‫Copy the source and go back to burb.
‫Open the decoder tab.
‫Pasted here.
‫And from the menu on the right to choose your URL and code, then.
‫Copy the encoded output.
‫Go back to the repeater tab.
‫Delete this part.
‫And at another return, character.
‫Then add the message header.
‫Pace the output here.
‫Then, Sam.
‫So the response came back, so that means there's no problem.
‫So now go to the recipient's address and click to have a look.
‫Now, I didn't add access code and I didn't want to make something else, but I can always make it pretty
‫and convincing if you want to use it.
‫Also, you can copy the e-mail format your customer uses and use that.
‫I know people who can even click the link in this email, so people still do.
‫So with a little bit of effort, you will spread a really good fishing e-mail and you'll have lots of
‫friends.