CamPhish — Control Front Camera of Mobile and PC | Hack WebCam

CamPhish — Control Front Camera of Mobile and PC | Hack WebCam

CamPhish is a camera phishing toolkit inspired from saycheese, it is a upgraded version of saycheese. We can get camera clicks from victim’s mobile’s front cam or PC’s webcam. We can use this on our Kali Linux and we also can use it on our Android mobile phone using Termux.

CamPhish have two automatic generated webpage templates for engaging target on that webpage so the attacker can get more camera snaps.

CamPhish -- Control Front Camera of Mobile and PC

CamPhish need some tools installed in our system, the tools are php openssh git wget. All these tools comes pre-installed with our Kali Linux system, so we start installation process by entering following command:

git clone https://github.com/techchipnet/CamPhish

It will be cloned on our current working directory, as we can see the process in the following screenshot:

camphish cloning from github

Then we need to to the CamPhish directory by using following command:

cd CamPhish

Then we give the permission to the shell script by running following command:

sudo chmod +x camphish.sh

After this we can run the tool by applying following command:

./camphish.sh

Then it will open it’s menu as we can see in the following screenshot:

camphish

Here we need to select the port forwarding option we can choose between ngrok and Serveo.net as we know serveo server goes down sometimes so we choose ngrok.

Then it will prompt for choose phishing template as we can see in the following screenshot:

chooseing phishing templet

Here we got two options, option 1 is festival wishing and other is YouTube. We can choose whatever depending on our social engineering. For an example we choose option 2 for YouTube.

youtube watch id

Here the YouTube watch ID means then end id of a YouTube video URL. The screenshot is following:

what is youtube whatch id
YouTube watch Id is the highlighted text

We copy a YouTube video’s watch ID as per our target’s interest and paste it on CamPhish.

If ngrok is not installed in our system then this tool now download and install ngrok in our system. Then it  will configure the server and automatically give us a link. This is the link as we can see in the following screenshot.

ngrok link

Here we can see that we got the ngrok link (can be opened from anywhere via internet) and now we can send this to victim with some social engineering twists. Sending phishing links to target is an art, we have discussed it on this tutorial.

Sometimes if the server’s are down then we can’t see the direct link it will be a blank space then we can see that it is running on our localhost:3333. Then we can use other port forwarding services to make it live on internet. For a reference we suggest you to read our this tutorial.

 
To hide the link as a pro we need to learn how to hide a phishing link.
Now whenever target clicks on the link it will open YouTube video in target’s browser and prompt for camera permission. Peoples usually don’t read about the permissions and clicked “OK”. BINGO! We got connected and we can get snaps from victim’s webcam/Frontcam. 

Here we can see that target got connected with our CamPhish server and we are getting camera shots. Those received images files will be saved in CamPhish directory. That is how we can take control of front cameras.

This tutorial is for educational
purpose and Proof of Concept only. Hack Webcam and Phishing is a crime. If anyone do any
illegal activity then we are not responsible for that.

KP AKA Koushik Pal is a Security researcher and specialist focused on educating about Linux for cybersecurity and URL‑masking vulnerabilities. Creator of MaskPhish, a well‑known open‑source bash-based URL‑masking tool. Linux enthusiasts Active speaker, trainer, and advocate for secure web practices.

84 comments

comments user
Unknown

no direct links after entering watch id

comments user
Kali Linux

Feeling sad that it doesn't work for you. What port forwarding options you have selected?

comments user
Unknown

where can i find received cam file ?

comments user
Kali Linux

The received images files will stored in CamPhish directory.

comments user
Anonymous

It's sad that the user will asked for a authorization. Regardless thank you!

comments user
Kali Linux

Thanks for reading it carefully. It is asked by the user's system security. One think we can do that trick the user to click on the "allow" button.

comments user
All In One

How we open camphish directory?

comments user
Kali Linux

We have run our script in CamPhish directory that means its our current working directory. Otherwise you can reach it by opening a new terminal and type
cd CamPhish

comments user
Aloiid

the pictures for me are black… HELP please

comments user
Salvatore_19

Asks username and password for github.

comments user
Kali Linux

It looks that you have misstyped the GitHub URL in git clone command… Please check it and type again.

comments user
Sunder Muthukumaran

only from the devices in same network can be obtained , right ??

comments user
Kali Linux

Nope. It comes with ngrok that will help us to grab snaps of anyone on the internet. Please read the article carefully till end.

comments user
Unknown

it can capture many images or just 1?

comments user
Unknown

root@kali:/home/kali# git clone https://github.com/techchipnet/CamPhish
Cloning into 'CamPhish'…
fatal: unable to access 'https://github.com/techchipnet/CamPhish/': Couldn't connect to server
it says like this

comments user
Kali Linux

it captures images contentiously when target whatching our link.

comments user
Kali Linux

make sure that you have a working internet connection.

comments user
Anonymous

Hi, Awesome tutorial.. thank you bro.. just 1 question, is there any way to change text in permission popup… "*.ngrok. is asking for permission for camera" can we change text here.. or is there any to way to block youtube video from playing if he rejects camera permission… Thank you….!!

comments user
Kali Linux

The permission popup is prompt by victim's browser, we can't bypass it. Because it didn't depend on our tool. In the case of YouTube video we will ask the tool maker if he can do something.

comments user
Unknown

hey ans the question the
direct links are blank

comments user
Kali Linux

Don't choose the serveo option. Try ngrok that will provide you a link

comments user
Anonymous

provavelmente negaram a solicitaΓ§Γ£o da camera

comments user
matrixman

tunnel .io is not found
what should i do ?
i did not receive any files

comments user
Kali Linux

seems there is a issue with the server please try after sometime

comments user
Anonymous

ngrok server started for the first time but now it's not responding. like i am not getting anything displayed after "starting ngrok server"

comments user
Kali Linux

It looks like the problem is coming from ngrok server. Wait some hour or a day then try again. Thank you.

comments user
Parthipan

I received ip Id but cannot received cam file

comments user
Kali Linux

can you please tell us what is the error?

comments user
Unknown

i dint get direct link but it is showing waiting targets
how do i get the link

comments user
Anonymous

how can i find call details of number by using kali linux tool

comments user
Kali Linux

In that case you need to use the HaxRat or L3MON tool. We have featured them in our articles. Try them.

comments user
Unknown

If we want the pictures of victim again! Then again we need to make him to click on that link?

And what if our machine is offline when victim is watching that link? Will the images come to my machine after I come online?

comments user
Kali Linux

Answer of the 1st question is 'YES'. You need to send the link again.

If your machine is offline and online again then our will not receive the pictures because the connection will broke. You need to be online constantly while attacking.

comments user
Anonymous

after i done everything it shows cannot read real time clock invalid argument

comments user
Kali Linux

Are you using WSL (Windows Subsystem for Linux) to run Kali ? This problem is comes from there. Check the solution here.

comments user
Musharaf parwej

Does it work for wsl……as i am not getting the link….it is blank

comments user
Kali Linux

Which method of port forwarding you have tried serveo or ngrok? Serveo server seems to be down. These kind of free services faces these problems. It happens with them sometimes. You should wait for their server come back online. Or host these pages on localhost and try portmap. Both these tutorial is available on our website.

comments user
Unknown

im able to send link and works perfectly with laptop cams. but i tried cellphone and not asking for the camera permission. any help?

comments user
Kali Linux

Did you tried on another mobile devices. Because we don't got this kind of issues.

comments user
Admin

i found image but blank image

comments user
Kali Linux

Did you tried this to anyone? May be your target is in a dark room.

comments user
Unknown

Open your hotspots to see the link

comments user
Lokendra beniwal

I didn't get the link even after starting the hotspot (in pc ) plss help

comments user
Kali Linux

Turning on the hotspot is for mobile not for PC. I think the serveo server is down. That's why the link is not generating.

comments user
Anonymous

the cam file is not been received on Kali

comments user
Kali Linux

The received images files will stored in CamPhish directory.

comments user
Anonymous

Hey, it works flawlessly on PC but on mobile, it doesn't work on newer OS

comments user
Kali Linux

The author told me to turn on mobiles wifi hotspot to use it with Termux.

comments user
Anonymous

I mean it doesn't capture anything on some phones, sorry for not being specific:)). Does it have something to do with phones security?

comments user
Rajpoot

how to open directory

comments user
popeye

all are blank images bro ive opened link in my mobile and i received all black images nothing is visible except black screen

comments user
Kali Linux

This tool requires up-gradation but the developer didn't looking on it. Let we talk with the developer.

comments user
Kali Linux

Here we showed this

comments user
Anonymous

Great tutorial. Since you're actually helping people with issues, I have one.
It works fine on a computer. However, the link crashes when I try and open it on Android. The site straight up refuses to open.

comments user
Anonymous

I'm using Android 10, by the way…

comments user
Kali Linux

Actually we are specially focused on Kali Linux. Not used Android for a while. But if possible can you provide some screenshot when site refuses to open it? Then might be we can help you. Thanks

comments user
Unknown

How to delete the pictures capturred by Camphish i couldnt delete it

comments user
Kali Linux

try to delete them from terminal using sudo. But be careful abusing sudo command can delete your whole Operating System files.

comments user
Anonymous

pictures received from victim's laptop are good but from mobile phone, they are black

comments user
Kali Linux

Many people facing this issue. We are trying to contact the original developer (thelinuxchoice) but he is not responding and he deleted his original GitHub repository. He just told us that he left cybersecurity.

comments user
Unknown

CamPhish direct link not working

comments user
Kali Linux

CamPhish is not updated from a long time.

comments user
Unknown

no link there,is that a bug?

comments user
Kali Linux

Using termux? then try turn on your mobile hotspot

comments user
Yusof antar

same here the link inst generated

comments user
Kali Linux

YAP. CamPhish is not working. It is outdated. Need up-gradation.

comments user
Painted wolf

I did every thing right and I am not able to get the pictures in CamPhish directory ,why? I am running Kali on VM Oracle.

comments user
Kali Linux

This project is not updated for a long time. There are lots of issues in the repository.

comments user
Unknown

Bro how to get those can files its not coming in manager what to do now the command are not working mv cam04Jul5.png /data/data/com.termux/files/home/storage/shared
mv: cannot move 'cam04Jul2023855.png' to '/data/data/com.termux/files/home/storage/shared': No such file or directory
It shows this

comments user
Kali Linux

It clear that there is no such files or directories. Are you sure about the location of file? You can share screenshots to us on our Telegram channel.

comments user
Youva imarazene

Hello I can't find the saved photos on my iphone

comments user
Kali Linux

Sorry. Don't have experience using camphish on iPhone.

comments user
Unknown

First start your hotspot to get link, then you can get the linkπŸ˜„

comments user
Anonymous

[!] Direct link is not generating, check following possible reason
Ngrok authtoken is not valid
[*] If you are using android, turn hotspot on
[*] Ngrok is already running, run this command killall ngrok
[*] Check your internet connection

pls tell ho to resolve this plsss

comments user
Kali Linux

Did you check all the solutions in your comment?

comments user
Anonymous

How do i uninstall camphish?

comments user
Anonymous

use the command rm -r camphish

comments user
Anonymous

mera work nhi kar raha ha
koi help karo

comments user
Anonymous

Bro help me

comments user
Anonymous

Thx Kali

comments user
Anonymous

How to install Kali Linux

comments user
Anonymous

do u know how disable permission pop up ( for webcam ) when target click on link. I've a last question, do u know how to disable webcam's led because it's very obvious.

comments user
Anonymous

Camera full black not working

comments user
Anonymous

what killall ngrok run mean to?

Post Comment