CamPhish -- Control Front Camera of Mobile and PC | Hack WebCam

CamPhish is a camera phishing toolkit inspired from saycheese, it is a upgraded version of saycheese. We can get camera clicks from victim's mobile's front cam or PC's webcam. We can use this on our Kali Linux and we also can use it on our Android mobile phone using Termux.

CamPhish have two automatic generated webpage templates for engaging target on that webpage so the attacker can get more camera snaps.

CamPhish -- Control Front Camera of Mobile and PC

CamPhish need some tools installed in our system, the tools are php openssh git wget. All these tools comes pre-installed with our Kali Linux system, so we start installation process by entering following command:

git clone https://github.com/techchipnet/CamPhish
It will be cloned on our current working directory, as we can see the process in the following screenshot:

camphish cloning from github

Then we need to to the CamPhish directory by using following command:

cd CamPhish
Then we give the permission to the shell script by running following command:

sudo chmod +x camphish.sh
After this we can run the tool by applying following command:

./camphish.sh
Then it will open it's menu as we can see in the following screenshot:

camphish

Here we need to select the port forwarding option we can choose between ngrok and Serveo.net as we know serveo server goes down sometimes so we choose ngrok.

Then it will prompt for choose phishing template as we can see in the following screenshot:

chooseing phishing templet

Here we got two options, option 1 is festival wishing and other is YouTube. We can choose whatever depending on our social engineering. For an example we choose option 2 for YouTube.

youtube watch id

Here the YouTube watch ID means then end id of a YouTube video URL. The screenshot is following:

what is youtube whatch id
YouTube watch Id is the highlighted text
We copy a YouTube video's watch ID as per our target's interest and paste it on CamPhish.

If ngrok is not installed in our system then this tool now download and install ngrok in our system. Then it  will configure the server and automatically give us a link. This is the link as we can see in the following screenshot.

ngrok link

Here we can see that we got the ngrok link (can be opened from anywhere via internet) and now we can send this to victim with some social engineering twists. Sending phishing links to target is an art, we have discussed it on this tutorial.

Now whenever target clicks on the link it will open YouTube video in target's browser and prompt for camera permission. Peoples usually don't read about the permissions and clicked "OK". BINGO! We got connected and we can get snaps from victim's webcam/Frontcam. 


Here we can see that target got connected with our CamPhish server and we are getting camera shots. Those received images files will be saved in CamPhish directory. That is how we can take control of front cameras.

This tutorial is for educational purpose and Proof of Concept only. Hack Webcam and Phishing is a crime. If anyone do any illegal activity then we are not responsible for that.

49 comments:

  1. no direct links after entering watch id

    ReplyDelete
    Replies
    1. Feeling sad that it doesn't work for you. What port forwarding options you have selected?

      Delete
    2. hey ans the question the
      direct links are blank

      Delete
    3. Don't choose the serveo option. Try ngrok that will provide you a link

      Delete
  2. where can i find received cam file ?

    ReplyDelete
    Replies
    1. The received images files will stored in CamPhish directory.

      Delete
  3. It's sad that the user will asked for a authorization. Regardless thank you!

    ReplyDelete
    Replies
    1. Thanks for reading it carefully. It is asked by the user's system security. One think we can do that trick the user to click on the "allow" button.

      Delete
  4. How we open camphish directory?

    ReplyDelete
    Replies
    1. We have run our script in CamPhish directory that means its our current working directory. Otherwise you can reach it by opening a new terminal and type
      cd CamPhish

      Delete
    2. Open your hotspots to see the link

      Delete
  5. the pictures for me are black... HELP please

    ReplyDelete
    Replies
    1. provavelmente negaram a solicitação da camera

      Delete
  6. Asks username and password for github.

    ReplyDelete
    Replies
    1. It looks that you have misstyped the GitHub URL in git clone command... Please check it and type again.

      Delete
  7. only from the devices in same network can be obtained , right ??

    ReplyDelete
    Replies
    1. Nope. It comes with ngrok that will help us to grab snaps of anyone on the internet. Please read the article carefully till end.

      Delete
  8. it can capture many images or just 1?

    ReplyDelete
    Replies
    1. it captures images contentiously when target whatching our link.

      Delete
  9. root@kali:/home/kali# git clone https://github.com/techchipnet/CamPhish
    Cloning into 'CamPhish'...
    fatal: unable to access 'https://github.com/techchipnet/CamPhish/': Couldn't connect to server
    it says like this

    ReplyDelete
    Replies
    1. make sure that you have a working internet connection.

      Delete
  10. Hi, Awesome tutorial.. thank you bro.. just 1 question, is there any way to change text in permission popup... "*.ngrok. is asking for permission for camera" can we change text here.. or is there any to way to block youtube video from playing if he rejects camera permission... Thank you....!!

    ReplyDelete
    Replies
    1. The permission popup is prompt by victim's browser, we can't bypass it. Because it didn't depend on our tool. In the case of YouTube video we will ask the tool maker if he can do something.

      Delete
  11. tunnel .io is not found
    what should i do ?
    i did not receive any files

    ReplyDelete
    Replies
    1. seems there is a issue with the server please try after sometime

      Delete
  12. ngrok server started for the first time but now it's not responding. like i am not getting anything displayed after "starting ngrok server"

    ReplyDelete
    Replies
    1. It looks like the problem is coming from ngrok server. Wait some hour or a day then try again. Thank you.

      Delete
  13. I received ip Id but cannot received cam file

    ReplyDelete
  14. i dint get direct link but it is showing waiting targets
    how do i get the link

    ReplyDelete
  15. how can i find call details of number by using kali linux tool

    ReplyDelete
    Replies
    1. In that case you need to use the HaxRat or L3MON tool. We have featured them in our articles. Try them.

      Delete
  16. If we want the pictures of victim again! Then again we need to make him to click on that link?

    And what if our machine is offline when victim is watching that link? Will the images come to my machine after I come online?

    ReplyDelete
    Replies
    1. Answer of the 1st question is 'YES'. You need to send the link again.

      If your machine is offline and online again then our will not receive the pictures because the connection will broke. You need to be online constantly while attacking.

      Delete
  17. after i done everything it shows cannot read real time clock invalid argument

    ReplyDelete
    Replies
    1. Are you using WSL (Windows Subsystem for Linux) to run Kali ? This problem is comes from there. Check the solution here.

      Delete
  18. Does it work for wsl......as i am not getting the link....it is blank

    ReplyDelete
    Replies
    1. Which method of port forwarding you have tried serveo or ngrok? Serveo server seems to be down. These kind of free services faces these problems. It happens with them sometimes. You should wait for their server come back online. Or host these pages on localhost and try portmap. Both these tutorial is available on our website.

      Delete
  19. im able to send link and works perfectly with laptop cams. but i tried cellphone and not asking for the camera permission. any help?

    ReplyDelete
    Replies
    1. Did you tried on another mobile devices. Because we don't got this kind of issues.

      Delete
  20. i found image but blank image

    ReplyDelete
    Replies
    1. Did you tried this to anyone? May be your target is in a dark room.

      Delete
  21. I didn't get the link even after starting the hotspot (in pc ) plss help

    ReplyDelete
    Replies
    1. Turning on the hotspot is for mobile not for PC. I think the serveo server is down. That's why the link is not generating.

      Delete
  22. the cam file is not been received on Kali

    ReplyDelete
    Replies
    1. The received images files will stored in CamPhish directory.

      Delete
  23. Hey, it works flawlessly on PC but on mobile, it doesn't work on newer OS

    ReplyDelete
    Replies
    1. The author told me to turn on mobiles wifi hotspot to use it with Termux.

      Delete
  24. I mean it doesn't capture anything on some phones, sorry for not being specific:)). Does it have something to do with phones security?

    ReplyDelete

Please do not spam here. It is comment box not a spambox. Promotional links are not allowed.

Powered by Blogger.