Hacking Book | Free Online Hacking Learning


see how i get ip location through email

Posted by harmelink at 2020-02-27

Remember that in those years, email phishing prevailed, and all kinds of advertising emails emerged in endlessly. Apart from the waterproof wall of the email, did you notice that the normal email could be used by the intentional people? This paper will use a more difficult way to detect the target IP.

0x00 check whether the message has been read

One day, when I was working, I sent an email to an important person, waiting left and right, thinking, did TA read my email? Now get the read status of your mailbox through a gesture? After the mail is opened, there is a great chance that the pictures in the mail will be loaded directly. First, prepare a server. The server's permission is better to have. Use the following code:

header('Content-Type:image/png'); $im = imagecreatetruecolor (1,1); $background_color = imagecolorallocatealpha($im, 255, 255, 255, 127); imagepng($im); imagedestroy($im);

The above code creates a 1x1 We put this picture on our own server. When we visit it, we can see a picture without anything: it's not enough to generate pictures. Let's record $server ['httpreferener '] and $server ['httpuser_agent'] which store where users come from and what user agents (browser devices) )In the end, there is also IP. We can get it through the following code: > reference: https://github.com/dxkite/suda/blob/master/system/src/suda/core/request.php × l211

function get_ip() {    static $ipFrom = ['HTTP_CLIENT_IP','HTTP_X_FORWARDED_FOR','HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP','HTTP_FORWARDED_FOR','HTTP_FORWARDED','REMOTE_ADDR'];    foreach ($ipFrom as $key) {        if (array_key_exists($key, $_SERVER)) {            foreach (explode(',', $_SERVER[$key]) as $ip) {                $ip = trim($ip);                if ((bool) filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {                    return $ip;                }            }        }    }    return  ''; }

After obtaining the above data, write it to the database:

$ip = get_ip(); $from = $_SERVER['HTTP_REFERER']; $client = $_SERVER['HTTP_USER_AGENT']; // SQL 插入到数据库中 // ...

After writing, we will insert our picture in the email (insert using URL). After receiving the picture, the other party may see that it is a small black dot (naming me as transparent). As long as the other party views this email, we can capture this data in the background. If you have requirements on the timeliness of the message, you can add a SMS notification (I use Penguin SMS here) to notify your mobile phone when the other party visits the page.

0x01 additional skills: IP positioning

In the previous step, we recorded each other's various information:

0x02 defects and Prevention

1. Open email with client

2. Web mail has a small chance to block pictures, but according to the current situation, there are several tests, Tencent and 163 are not blocked

3. Unless the proxy is used to access the Internet, the positioning effect is OK under normal circumstances

4. It is applicable to detect whether the email has been read or not. Positioning IP is only an incidental effect, but it can not be ignored (Ang, positioning at TA's home, and will not reply to my email)

*The original author of this article: dxkite, this article belongs to the freebuf original award program, reprint is prohibited without permission