mirror of https://github.com/gophish/gophish
Moved phishing handlers into separate file and added a ton of tests.
Jordan Wright
parent
b6653d5c94
commit
e42302ebf9
|
|
@ -24,6 +24,9 @@ type ControllersSuite struct {
|
||||||
// as is the Admin Server for our API calls
|
// as is the Admin Server for our API calls
|
||||||
var as *httptest.Server = httptest.NewUnstartedServer(handlers.CombinedLoggingHandler(os.Stdout, CreateAdminRouter()))
|
var as *httptest.Server = httptest.NewUnstartedServer(handlers.CombinedLoggingHandler(os.Stdout, CreateAdminRouter()))
|
||||||
|
|
||||||
|
// ps is the Phishing Server
|
||||||
|
var ps *httptest.Server = httptest.NewUnstartedServer(handlers.CombinedLoggingHandler(os.Stdout, CreatePhishingRouter()))
|
||||||
|
|
||||||
func (s *ControllersSuite) SetupSuite() {
|
func (s *ControllersSuite) SetupSuite() {
|
||||||
config.Conf.DBName = "sqlite3"
|
config.Conf.DBName = "sqlite3"
|
||||||
config.Conf.DBPath = ":memory:"
|
config.Conf.DBPath = ":memory:"
|
||||||
|
|
@ -40,6 +43,63 @@ func (s *ControllersSuite) SetupSuite() {
|
||||||
u, err := models.GetUser(1)
|
u, err := models.GetUser(1)
|
||||||
s.Nil(err)
|
s.Nil(err)
|
||||||
s.ApiKey = u.ApiKey
|
s.ApiKey = u.ApiKey
|
||||||
|
// Start the phishing server
|
||||||
|
ps.Config.Addr = config.Conf.PhishConf.ListenURL
|
||||||
|
ps.Start()
|
||||||
|
// Move our cwd up to the project root for help with resolving
|
||||||
|
// static assets
|
||||||
|
err = os.Chdir("../")
|
||||||
|
s.Nil(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *ControllersSuite) TearDownTest() {
|
||||||
|
campaigns, _ := models.GetCampaigns(1)
|
||||||
|
for _, campaign := range campaigns {
|
||||||
|
models.DeleteCampaign(campaign.Id)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *ControllersSuite) SetupTest() {
|
||||||
|
// Add a group
|
||||||
|
group := models.Group{Name: "Test Group"}
|
||||||
|
group.Targets = []models.Target{
|
||||||
|
models.Target{Email: "test1@example.com", FirstName: "First", LastName: "Example"},
|
||||||
|
models.Target{Email: "test2@example.com", FirstName: "Second", LastName: "Example"},
|
||||||
|
}
|
||||||
|
group.UserId = 1
|
||||||
|
models.PostGroup(&group)
|
||||||
|
|
||||||
|
// Add a template
|
||||||
|
t := models.Template{Name: "Test Template"}
|
||||||
|
t.Subject = "Test subject"
|
||||||
|
t.Text = "Text text"
|
||||||
|
t.HTML = "<html>Test</html>"
|
||||||
|
t.UserId = 1
|
||||||
|
models.PostTemplate(&t)
|
||||||
|
|
||||||
|
// Add a landing page
|
||||||
|
p := models.Page{Name: "Test Page"}
|
||||||
|
p.HTML = "<html>Test</html>"
|
||||||
|
p.UserId = 1
|
||||||
|
models.PostPage(&p)
|
||||||
|
|
||||||
|
// Add a sending profile
|
||||||
|
smtp := models.SMTP{Name: "Test Page"}
|
||||||
|
smtp.UserId = 1
|
||||||
|
smtp.Host = "example.com"
|
||||||
|
smtp.FromAddress = "test@test.com"
|
||||||
|
models.PostSMTP(&smtp)
|
||||||
|
|
||||||
|
// Setup and "launch" our campaign
|
||||||
|
// Set the status such that no emails are attempted
|
||||||
|
c := models.Campaign{Name: "Test campaign"}
|
||||||
|
c.UserId = 1
|
||||||
|
c.Template = t
|
||||||
|
c.Page = p
|
||||||
|
c.SMTP = smtp
|
||||||
|
c.Groups = []models.Group{group}
|
||||||
|
models.PostCampaign(&c, c.UserId)
|
||||||
|
c.UpdateStatus(models.CAMPAIGN_EMAILS_SENT)
|
||||||
}
|
}
|
||||||
|
|
||||||
func (s *ControllersSuite) TestSiteImportBaseHref() {
|
func (s *ControllersSuite) TestSiteImportBaseHref() {
|
||||||
|
|
@ -65,8 +125,9 @@ func (s *ControllersSuite) TestSiteImportBaseHref() {
|
||||||
}
|
}
|
||||||
|
|
||||||
func (s *ControllersSuite) TearDownSuite() {
|
func (s *ControllersSuite) TearDownSuite() {
|
||||||
// Tear down the admin server
|
// Tear down the admin and phishing servers
|
||||||
as.Close()
|
as.Close()
|
||||||
|
ps.Close()
|
||||||
}
|
}
|
||||||
|
|
||||||
func TestControllerSuite(t *testing.T) {
|
func TestControllerSuite(t *testing.T) {
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,202 @@
|
||||||
|
package controllers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"encoding/json"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"html/template"
|
||||||
|
"net"
|
||||||
|
"net/http"
|
||||||
|
"net/mail"
|
||||||
|
"net/url"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
ctx "github.com/gophish/gophish/context"
|
||||||
|
"github.com/gophish/gophish/models"
|
||||||
|
"github.com/gorilla/mux"
|
||||||
|
)
|
||||||
|
|
||||||
|
// ErrInvalidRequest is thrown when a request with an invalid structure is
|
||||||
|
// received
|
||||||
|
var ErrInvalidRequest = errors.New("Invalid request")
|
||||||
|
|
||||||
|
// ErrCampaignComplete is thrown when an event is received for a campaign that
|
||||||
|
// has already been marked as complete.
|
||||||
|
var ErrCampaignComplete = errors.New("Event received on completed campaign")
|
||||||
|
|
||||||
|
// eventDetails is a struct that wraps common attributes we want to store
|
||||||
|
// in an event
|
||||||
|
type eventDetails struct {
|
||||||
|
Payload url.Values `json:"payload"`
|
||||||
|
Browser map[string]string `json:"browser"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// CreatePhishingRouter creates the router that handles phishing connections.
|
||||||
|
func CreatePhishingRouter() http.Handler {
|
||||||
|
router := mux.NewRouter()
|
||||||
|
router.PathPrefix("/static/").Handler(http.StripPrefix("/static/", http.FileServer(http.Dir("./static/endpoint/"))))
|
||||||
|
router.HandleFunc("/track", PhishTracker)
|
||||||
|
router.HandleFunc("/robots.txt", RobotsHandler)
|
||||||
|
router.HandleFunc("/{path:.*}/track", PhishTracker)
|
||||||
|
router.HandleFunc("/{path:.*}", PhishHandler)
|
||||||
|
return router
|
||||||
|
}
|
||||||
|
|
||||||
|
// PhishTracker tracks emails as they are opened, updating the status for the given Result
|
||||||
|
func PhishTracker(w http.ResponseWriter, r *http.Request) {
|
||||||
|
err, r := setupContext(r)
|
||||||
|
if err != nil {
|
||||||
|
// Log the error if it wasn't something we can safely ignore
|
||||||
|
if err != ErrInvalidRequest && err != ErrCampaignComplete {
|
||||||
|
Logger.Println(err)
|
||||||
|
}
|
||||||
|
http.NotFound(w, r)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
rs := ctx.Get(r, "result").(models.Result)
|
||||||
|
c := ctx.Get(r, "campaign").(models.Campaign)
|
||||||
|
rj := ctx.Get(r, "details").([]byte)
|
||||||
|
c.AddEvent(models.Event{Email: rs.Email, Message: models.EVENT_OPENED, Details: string(rj)})
|
||||||
|
// Don't update the status if the user already clicked the link
|
||||||
|
// or submitted data to the campaign
|
||||||
|
if rs.Status == models.EVENT_CLICKED || rs.Status == models.EVENT_DATA_SUBMIT {
|
||||||
|
http.ServeFile(w, r, "static/images/pixel.png")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
err = rs.UpdateStatus(models.EVENT_OPENED)
|
||||||
|
if err != nil {
|
||||||
|
Logger.Println(err)
|
||||||
|
}
|
||||||
|
http.ServeFile(w, r, "static/images/pixel.png")
|
||||||
|
}
|
||||||
|
|
||||||
|
// PhishHandler handles incoming client connections and registers the associated actions performed
|
||||||
|
// (such as clicked link, etc.)
|
||||||
|
func PhishHandler(w http.ResponseWriter, r *http.Request) {
|
||||||
|
err, r := setupContext(r)
|
||||||
|
if err != nil {
|
||||||
|
// Log the error if it wasn't something we can safely ignore
|
||||||
|
if err != ErrInvalidRequest && err != ErrCampaignComplete {
|
||||||
|
Logger.Println(err)
|
||||||
|
}
|
||||||
|
http.NotFound(w, r)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
rs := ctx.Get(r, "result").(models.Result)
|
||||||
|
c := ctx.Get(r, "campaign").(models.Campaign)
|
||||||
|
rj := ctx.Get(r, "details").([]byte)
|
||||||
|
p, err := models.GetPage(c.PageId, c.UserId)
|
||||||
|
if err != nil {
|
||||||
|
Logger.Println(err)
|
||||||
|
}
|
||||||
|
switch {
|
||||||
|
case r.Method == "GET":
|
||||||
|
if rs.Status != models.EVENT_CLICKED && rs.Status != models.EVENT_DATA_SUBMIT {
|
||||||
|
rs.UpdateStatus(models.EVENT_CLICKED)
|
||||||
|
}
|
||||||
|
err = c.AddEvent(models.Event{Email: rs.Email, Message: models.EVENT_CLICKED, Details: string(rj)})
|
||||||
|
if err != nil {
|
||||||
|
Logger.Println(err)
|
||||||
|
}
|
||||||
|
case r.Method == "POST":
|
||||||
|
// If data was POST'ed, let's record it
|
||||||
|
rs.UpdateStatus(models.EVENT_DATA_SUBMIT)
|
||||||
|
// Store the data in an event
|
||||||
|
c.AddEvent(models.Event{Email: rs.Email, Message: models.EVENT_DATA_SUBMIT, Details: string(rj)})
|
||||||
|
if err != nil {
|
||||||
|
Logger.Println(err)
|
||||||
|
}
|
||||||
|
// Redirect to the desired page
|
||||||
|
if p.RedirectURL != "" {
|
||||||
|
http.Redirect(w, r, p.RedirectURL, 302)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
}
|
||||||
|
var htmlBuff bytes.Buffer
|
||||||
|
tmpl, err := template.New("html_template").Parse(p.HTML)
|
||||||
|
if err != nil {
|
||||||
|
Logger.Println(err)
|
||||||
|
http.NotFound(w, r)
|
||||||
|
}
|
||||||
|
f, err := mail.ParseAddress(c.SMTP.FromAddress)
|
||||||
|
if err != nil {
|
||||||
|
Logger.Println(err)
|
||||||
|
}
|
||||||
|
fn := f.Name
|
||||||
|
if fn == "" {
|
||||||
|
fn = f.Address
|
||||||
|
}
|
||||||
|
rsf := struct {
|
||||||
|
models.Result
|
||||||
|
URL string
|
||||||
|
From string
|
||||||
|
}{
|
||||||
|
rs,
|
||||||
|
c.URL + "?rid=" + rs.RId,
|
||||||
|
fn,
|
||||||
|
}
|
||||||
|
err = tmpl.Execute(&htmlBuff, rsf)
|
||||||
|
if err != nil {
|
||||||
|
Logger.Println(err)
|
||||||
|
http.NotFound(w, r)
|
||||||
|
}
|
||||||
|
w.Write(htmlBuff.Bytes())
|
||||||
|
}
|
||||||
|
|
||||||
|
// RobotsHandler prevents search engines, etc. from indexing phishing materials
|
||||||
|
func RobotsHandler(w http.ResponseWriter, r *http.Request) {
|
||||||
|
fmt.Fprintln(w, "User-agent: *\nDisallow: /")
|
||||||
|
}
|
||||||
|
|
||||||
|
// setupContext handles some of the administrative work around receiving a new request, such as checking the result ID, the campaign, etc.
|
||||||
|
func setupContext(r *http.Request) (error, *http.Request) {
|
||||||
|
err := r.ParseForm()
|
||||||
|
if err != nil {
|
||||||
|
Logger.Println(err)
|
||||||
|
return err, r
|
||||||
|
}
|
||||||
|
id := r.Form.Get("rid")
|
||||||
|
if id == "" {
|
||||||
|
return ErrInvalidRequest, r
|
||||||
|
}
|
||||||
|
rs, err := models.GetResult(id)
|
||||||
|
if err != nil {
|
||||||
|
return err, r
|
||||||
|
}
|
||||||
|
c, err := models.GetCampaign(rs.CampaignId, rs.UserId)
|
||||||
|
if err != nil {
|
||||||
|
Logger.Println(err)
|
||||||
|
return err, r
|
||||||
|
}
|
||||||
|
// Don't process events for completed campaigns
|
||||||
|
if c.Status == models.CAMPAIGN_COMPLETE {
|
||||||
|
return ErrCampaignComplete, r
|
||||||
|
}
|
||||||
|
ip, _, err := net.SplitHostPort(r.RemoteAddr)
|
||||||
|
if err != nil {
|
||||||
|
Logger.Println(err)
|
||||||
|
return err, r
|
||||||
|
}
|
||||||
|
// Respect X-Forwarded headers
|
||||||
|
if fips := r.Header.Get("X-Forwarded-For"); fips != "" {
|
||||||
|
ip = strings.Split(fips, ", ")[0]
|
||||||
|
}
|
||||||
|
// Handle post processing such as GeoIP
|
||||||
|
err = rs.UpdateGeo(ip)
|
||||||
|
if err != nil {
|
||||||
|
Logger.Println(err)
|
||||||
|
}
|
||||||
|
d := eventDetails{
|
||||||
|
Payload: r.Form,
|
||||||
|
Browser: make(map[string]string),
|
||||||
|
}
|
||||||
|
d.Browser["address"] = ip
|
||||||
|
d.Browser["user-agent"] = r.Header.Get("User-Agent")
|
||||||
|
rj, err := json.Marshal(d)
|
||||||
|
|
||||||
|
r = ctx.Set(r, "result", rs)
|
||||||
|
r = ctx.Set(r, "campaign", c)
|
||||||
|
r = ctx.Set(r, "details", rj)
|
||||||
|
return nil, r
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,128 @@
|
||||||
|
package controllers
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"fmt"
|
||||||
|
"io/ioutil"
|
||||||
|
"net/http"
|
||||||
|
|
||||||
|
"github.com/gophish/gophish/models"
|
||||||
|
)
|
||||||
|
|
||||||
|
func (s *ControllersSuite) getFirstCampaign() models.Campaign {
|
||||||
|
campaigns, err := models.GetCampaigns(1)
|
||||||
|
s.Nil(err)
|
||||||
|
return campaigns[0]
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *ControllersSuite) openEmail(rid string) {
|
||||||
|
resp, err := http.Get(fmt.Sprintf("%s/track?rid=%s", ps.URL, rid))
|
||||||
|
s.Nil(err)
|
||||||
|
defer resp.Body.Close()
|
||||||
|
body, err := ioutil.ReadAll(resp.Body)
|
||||||
|
s.Nil(err)
|
||||||
|
expected, err := ioutil.ReadFile("static/images/pixel.png")
|
||||||
|
s.Nil(err)
|
||||||
|
s.Equal(bytes.Compare(body, expected), 0)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *ControllersSuite) openEmail404(rid string) {
|
||||||
|
resp, err := http.Get(fmt.Sprintf("%s/track?rid=%s", ps.URL, rid))
|
||||||
|
s.Nil(err)
|
||||||
|
defer resp.Body.Close()
|
||||||
|
s.Nil(err)
|
||||||
|
s.Equal(resp.StatusCode, http.StatusNotFound)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *ControllersSuite) clickLink(rid string, campaign models.Campaign) {
|
||||||
|
resp, err := http.Get(fmt.Sprintf("%s/?rid=%s", ps.URL, rid))
|
||||||
|
s.Nil(err)
|
||||||
|
defer resp.Body.Close()
|
||||||
|
body, err := ioutil.ReadAll(resp.Body)
|
||||||
|
s.Nil(err)
|
||||||
|
s.Equal(bytes.Compare(body, []byte(campaign.Page.HTML)), 0)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *ControllersSuite) clickLink404(rid string) {
|
||||||
|
resp, err := http.Get(fmt.Sprintf("%s/?rid=%s", ps.URL, rid))
|
||||||
|
s.Nil(err)
|
||||||
|
defer resp.Body.Close()
|
||||||
|
s.Nil(err)
|
||||||
|
s.Equal(resp.StatusCode, http.StatusNotFound)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *ControllersSuite) TestOpenedPhishingEmail() {
|
||||||
|
campaign := s.getFirstCampaign()
|
||||||
|
result := campaign.Results[0]
|
||||||
|
s.Equal(result.Status, models.STATUS_SENDING)
|
||||||
|
|
||||||
|
s.openEmail(result.RId)
|
||||||
|
|
||||||
|
campaign = s.getFirstCampaign()
|
||||||
|
result = campaign.Results[0]
|
||||||
|
s.Equal(result.Status, models.EVENT_OPENED)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *ControllersSuite) TestClickedPhishingLinkAfterOpen() {
|
||||||
|
campaign := s.getFirstCampaign()
|
||||||
|
result := campaign.Results[0]
|
||||||
|
s.Equal(result.Status, models.STATUS_SENDING)
|
||||||
|
|
||||||
|
s.openEmail(result.RId)
|
||||||
|
s.clickLink(result.RId, campaign)
|
||||||
|
|
||||||
|
campaign = s.getFirstCampaign()
|
||||||
|
result = campaign.Results[0]
|
||||||
|
s.Equal(result.Status, models.EVENT_CLICKED)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *ControllersSuite) TestNoRecipientID() {
|
||||||
|
resp, err := http.Get(fmt.Sprintf("%s/track", ps.URL))
|
||||||
|
s.Nil(err)
|
||||||
|
s.Equal(resp.StatusCode, http.StatusNotFound)
|
||||||
|
|
||||||
|
resp, err = http.Get(ps.URL)
|
||||||
|
s.Nil(err)
|
||||||
|
s.Equal(resp.StatusCode, http.StatusNotFound)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *ControllersSuite) TestInvalidRecipientID() {
|
||||||
|
rid := "XXXXXXXXXX"
|
||||||
|
resp, err := http.Get(fmt.Sprintf("%s/track?rid=%s", ps.URL, rid))
|
||||||
|
s.Nil(err)
|
||||||
|
s.Equal(resp.StatusCode, http.StatusNotFound)
|
||||||
|
|
||||||
|
resp, err = http.Get(fmt.Sprintf("%s/?rid=%s", ps.URL, rid))
|
||||||
|
s.Nil(err)
|
||||||
|
s.Equal(resp.StatusCode, http.StatusNotFound)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *ControllersSuite) TestCompletedCampaignClick() {
|
||||||
|
campaign := s.getFirstCampaign()
|
||||||
|
result := campaign.Results[0]
|
||||||
|
s.Equal(result.Status, models.STATUS_SENDING)
|
||||||
|
s.openEmail(result.RId)
|
||||||
|
|
||||||
|
campaign = s.getFirstCampaign()
|
||||||
|
result = campaign.Results[0]
|
||||||
|
s.Equal(result.Status, models.EVENT_OPENED)
|
||||||
|
|
||||||
|
models.CompleteCampaign(campaign.Id, 1)
|
||||||
|
s.openEmail404(result.RId)
|
||||||
|
s.clickLink404(result.RId)
|
||||||
|
|
||||||
|
campaign = s.getFirstCampaign()
|
||||||
|
result = campaign.Results[0]
|
||||||
|
s.Equal(result.Status, models.EVENT_OPENED)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *ControllersSuite) TestRobotsHandler() {
|
||||||
|
expected := []byte("User-agent: *\nDisallow: /\n")
|
||||||
|
resp, err := http.Get(fmt.Sprintf("%s/robots.txt", ps.URL))
|
||||||
|
s.Nil(err)
|
||||||
|
s.Equal(resp.StatusCode, http.StatusOK)
|
||||||
|
defer resp.Body.Close()
|
||||||
|
body, err := ioutil.ReadAll(resp.Body)
|
||||||
|
s.Nil(err)
|
||||||
|
s.Equal(bytes.Compare(body, expected), 0)
|
||||||
|
}
|
||||||
|
|
@ -1,17 +1,11 @@
|
||||||
package controllers
|
package controllers
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"bytes"
|
|
||||||
"encoding/json"
|
|
||||||
"fmt"
|
"fmt"
|
||||||
"html/template"
|
"html/template"
|
||||||
"log"
|
"log"
|
||||||
"net"
|
|
||||||
"net/http"
|
"net/http"
|
||||||
"net/mail"
|
|
||||||
"net/url"
|
|
||||||
"os"
|
"os"
|
||||||
"strings"
|
|
||||||
|
|
||||||
"github.com/gophish/gophish/auth"
|
"github.com/gophish/gophish/auth"
|
||||||
"github.com/gophish/gophish/config"
|
"github.com/gophish/gophish/config"
|
||||||
|
|
@ -79,204 +73,6 @@ func CreateAdminRouter() http.Handler {
|
||||||
return Use(csrfRouter.ServeHTTP, mid.CSRFExceptions, mid.GetContext)
|
return Use(csrfRouter.ServeHTTP, mid.CSRFExceptions, mid.GetContext)
|
||||||
}
|
}
|
||||||
|
|
||||||
// CreatePhishingRouter creates the router that handles phishing connections.
|
|
||||||
func CreatePhishingRouter() http.Handler {
|
|
||||||
router := mux.NewRouter()
|
|
||||||
router.PathPrefix("/static/").Handler(http.StripPrefix("/static/", http.FileServer(http.Dir("./static/endpoint/"))))
|
|
||||||
router.HandleFunc("/track", PhishTracker)
|
|
||||||
router.HandleFunc("/robots.txt", RobotsHandler)
|
|
||||||
router.HandleFunc("/{path:.*}/track", PhishTracker)
|
|
||||||
router.HandleFunc("/{path:.*}", PhishHandler)
|
|
||||||
return router
|
|
||||||
}
|
|
||||||
|
|
||||||
// PhishTracker tracks emails as they are opened, updating the status for the given Result
|
|
||||||
func PhishTracker(w http.ResponseWriter, r *http.Request) {
|
|
||||||
r.ParseForm()
|
|
||||||
id := r.Form.Get("rid")
|
|
||||||
if id == "" {
|
|
||||||
Logger.Println("Missing Result ID")
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
rs, err := models.GetResult(id)
|
|
||||||
if err != nil {
|
|
||||||
Logger.Println("No Results found")
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
c, err := models.GetCampaign(rs.CampaignId, rs.UserId)
|
|
||||||
if err != nil {
|
|
||||||
Logger.Println(err)
|
|
||||||
}
|
|
||||||
// Don't process events for completed campaigns
|
|
||||||
if c.Status == models.CAMPAIGN_COMPLETE {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
ip, _, err := net.SplitHostPort(r.RemoteAddr)
|
|
||||||
if err != nil {
|
|
||||||
Logger.Println(err)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
// Respect X-Forwarded headers
|
|
||||||
if fips := r.Header.Get("X-Forwarded-For"); fips != "" {
|
|
||||||
ip = strings.Split(fips, ", ")[0]
|
|
||||||
}
|
|
||||||
// Handle post processing such as GeoIP
|
|
||||||
err = rs.UpdateGeo(ip)
|
|
||||||
if err != nil {
|
|
||||||
Logger.Println(err)
|
|
||||||
}
|
|
||||||
d := struct {
|
|
||||||
Payload url.Values `json:"payload"`
|
|
||||||
Browser map[string]string `json:"browser"`
|
|
||||||
}{
|
|
||||||
Payload: r.Form,
|
|
||||||
Browser: make(map[string]string),
|
|
||||||
}
|
|
||||||
d.Browser["address"] = ip
|
|
||||||
d.Browser["user-agent"] = r.Header.Get("User-Agent")
|
|
||||||
rj, err := json.Marshal(d)
|
|
||||||
if err != nil {
|
|
||||||
Logger.Println(err)
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
c.AddEvent(models.Event{Email: rs.Email, Message: models.EVENT_OPENED, Details: string(rj)})
|
|
||||||
// Don't update the status if the user already clicked the link
|
|
||||||
// or submitted data to the campaign
|
|
||||||
if rs.Status == models.EVENT_CLICKED || rs.Status == models.EVENT_DATA_SUBMIT {
|
|
||||||
http.ServeFile(w, r, "static/images/pixel.png")
|
|
||||||
return
|
|
||||||
}
|
|
||||||
err = rs.UpdateStatus(models.EVENT_OPENED)
|
|
||||||
if err != nil {
|
|
||||||
Logger.Println(err)
|
|
||||||
}
|
|
||||||
http.ServeFile(w, r, "static/images/pixel.png")
|
|
||||||
}
|
|
||||||
|
|
||||||
// PhishHandler handles incoming client connections and registers the associated actions performed
|
|
||||||
// (such as clicked link, etc.)
|
|
||||||
func PhishHandler(w http.ResponseWriter, r *http.Request) {
|
|
||||||
err := r.ParseForm()
|
|
||||||
if err != nil {
|
|
||||||
Logger.Println(err)
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
id := r.Form.Get("rid")
|
|
||||||
if id == "" {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
rs, err := models.GetResult(id)
|
|
||||||
if err != nil {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
c, err := models.GetCampaign(rs.CampaignId, rs.UserId)
|
|
||||||
if err != nil {
|
|
||||||
Logger.Println(err)
|
|
||||||
}
|
|
||||||
// Don't process events for completed campaigns
|
|
||||||
if c.Status == models.CAMPAIGN_COMPLETE {
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
p, err := models.GetPage(c.PageId, c.UserId)
|
|
||||||
if err != nil {
|
|
||||||
Logger.Println(err)
|
|
||||||
}
|
|
||||||
d := struct {
|
|
||||||
Payload url.Values `json:"payload"`
|
|
||||||
Browser map[string]string `json:"browser"`
|
|
||||||
}{
|
|
||||||
Payload: r.Form,
|
|
||||||
Browser: make(map[string]string),
|
|
||||||
}
|
|
||||||
ip, _, err := net.SplitHostPort(r.RemoteAddr)
|
|
||||||
if err != nil {
|
|
||||||
Logger.Println(err)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
// Respect X-Forwarded headers
|
|
||||||
if fips := r.Header.Get("X-Forwarded-For"); fips != "" {
|
|
||||||
ip = strings.Split(fips, ", ")[0]
|
|
||||||
}
|
|
||||||
// Handle post processing such as GeoIP
|
|
||||||
err = rs.UpdateGeo(ip)
|
|
||||||
if err != nil {
|
|
||||||
Logger.Println(err)
|
|
||||||
}
|
|
||||||
d.Browser["address"] = ip
|
|
||||||
d.Browser["user-agent"] = r.Header.Get("User-Agent")
|
|
||||||
rj, err := json.Marshal(d)
|
|
||||||
if err != nil {
|
|
||||||
Logger.Println(err)
|
|
||||||
http.NotFound(w, r)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
switch {
|
|
||||||
case r.Method == "GET":
|
|
||||||
if rs.Status != models.EVENT_CLICKED && rs.Status != models.EVENT_DATA_SUBMIT {
|
|
||||||
rs.UpdateStatus(models.EVENT_CLICKED)
|
|
||||||
}
|
|
||||||
err = c.AddEvent(models.Event{Email: rs.Email, Message: models.EVENT_CLICKED, Details: string(rj)})
|
|
||||||
if err != nil {
|
|
||||||
Logger.Println(err)
|
|
||||||
}
|
|
||||||
case r.Method == "POST":
|
|
||||||
// If data was POST'ed, let's record it
|
|
||||||
rs.UpdateStatus(models.EVENT_DATA_SUBMIT)
|
|
||||||
// Store the data in an event
|
|
||||||
c.AddEvent(models.Event{Email: rs.Email, Message: models.EVENT_DATA_SUBMIT, Details: string(rj)})
|
|
||||||
if err != nil {
|
|
||||||
Logger.Println(err)
|
|
||||||
}
|
|
||||||
// Redirect to the desired page
|
|
||||||
if p.RedirectURL != "" {
|
|
||||||
http.Redirect(w, r, p.RedirectURL, 302)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
}
|
|
||||||
var htmlBuff bytes.Buffer
|
|
||||||
tmpl, err := template.New("html_template").Parse(p.HTML)
|
|
||||||
if err != nil {
|
|
||||||
Logger.Println(err)
|
|
||||||
http.NotFound(w, r)
|
|
||||||
}
|
|
||||||
f, err := mail.ParseAddress(c.SMTP.FromAddress)
|
|
||||||
if err != nil {
|
|
||||||
Logger.Println(err)
|
|
||||||
}
|
|
||||||
fn := f.Name
|
|
||||||
if fn == "" {
|
|
||||||
fn = f.Address
|
|
||||||
}
|
|
||||||
rsf := struct {
|
|
||||||
models.Result
|
|
||||||
URL string
|
|
||||||
From string
|
|
||||||
}{
|
|
||||||
rs,
|
|
||||||
c.URL + "?rid=" + rs.RId,
|
|
||||||
fn,
|
|
||||||
}
|
|
||||||
err = tmpl.Execute(&htmlBuff, rsf)
|
|
||||||
if err != nil {
|
|
||||||
Logger.Println(err)
|
|
||||||
http.NotFound(w, r)
|
|
||||||
}
|
|
||||||
w.Write(htmlBuff.Bytes())
|
|
||||||
}
|
|
||||||
|
|
||||||
// RobotsHandler prevents search engines, etc. from indexing phishing materials
|
|
||||||
func RobotsHandler(w http.ResponseWriter, r *http.Request) {
|
|
||||||
fmt.Fprintln(w, "User-agent: *\nDisallow: /")
|
|
||||||
}
|
|
||||||
|
|
||||||
// Use allows us to stack middleware to process the request
|
// Use allows us to stack middleware to process the request
|
||||||
// Example taken from https://github.com/gorilla/mux/pull/36#issuecomment-25849172
|
// Example taken from https://github.com/gorilla/mux/pull/36#issuecomment-25849172
|
||||||
func Use(handler http.HandlerFunc, mid ...func(http.Handler) http.HandlerFunc) http.HandlerFunc {
|
func Use(handler http.HandlerFunc, mid ...func(http.Handler) http.HandlerFunc) http.HandlerFunc {
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue