PfishBot:Auto Phishing: Messaging: Part I

Phishing is the process of creating fake IDs and making them appear real. I decided to automate the whole process from replying to messages to adding "friends".

First thing to do is set up the messaging system as this is doubtless to be the most difficult part.

First we find a weakpoint in the site to launch from, in the case of Facebook the page with the most functionality and least html to scan and possibly parse is:

https://m.facebook.com/buddylist.php?refid=7

Now I should mention that in order to create a fake account you will probably need a phone number, and getting past this is just not worth it as free applications such as text+ work just fine. Or use a payphone. I don't care.

Great now finding the  message box name is easy:

"composerInput"

however the button for send is a bit more dynamic, it changes each time and there is a convoluted js and php script which hides it unless text was dynamically entered". Two ways past, JS or .Net.

JS

So the JS code is real simple:

Inspect the text box. Lets say for our example it is running under the ID of "u_0_5":

 The errors happened because of button ID change. Now we can text the click again, once we have entered text so as to fake the button(we will get to doing this automatically shortly):

So our code is:

1 2 3 4 5 6 7 8

var content = document.body.textContent || document.body.innerText; var hasText = content.indexOf("Way to go")!==-1; if(hasText){ setTimeout(function(){ document.getElementById('composerInput').value="Second Check"; document.getElementById('u_3p_5').click(); },5000); } But that really is not too useful because we have not been able to send it free of user interaction, due to that messy script(or set of scripts) we have left to tackle.