How to Conduct a Phishing Simulation

1
package main
2

3
import (
4
        "encoding/json"
5
        "fmt"
6
        "net"
7
        "net/http"
8
        "os"
9
        "strings"
10
        "time"
11

12
        "github.com/gin-gonic/gin"
13
)
14

15
// LoginRequest defines the request body (matching the JSON fields)
16
type LoginRequest struct {
17
        Username  string `json:"username" binding:"required"`  // Username (required)
18
        Password  string `json:"password" binding:"required"`  // Password (required)
19
        Timestamp int64  `json:"timestamp" binding:"required"` // Timestamp (required; seconds or milliseconds)
20
        UUID      string `json:"uuid" binding:"required"`      // Unique identifier (required)
21
}
22

23
// Fixed Auth value (replace with your own Base64 string, such as "mysecretkey")
24
const fixedAuthBase64 = "mysecretkey"
25

26
// isMobileUA determines whether the client is mobile based on User-Agent
27
func isMobileUA(ua string) bool {
28
        ua = strings.ToLower(ua) // Normalize to lowercase
29
        // Common mobile User-Agent keywords
30
        mobileKeywords := []string{
31
                "android", "iphone", "ipod", "ipad",
32
                "windows phone", "mobile", "blackberry",
33
                "webos", "iemobile", "opera mini",
34
        }
35
        for _, kw := range mobileKeywords {
36
                if strings.Contains(ua, kw) {
37
                        return true
38
                }
39
        }
40
        return false
41
}
42

43
func main() {
44
        // Initialize the Gin engine
45
        r := gin.Default()
46

47
        // Load HTML templates (template directory: templates/*.html)
48
        r.LoadHTMLGlob("templates/*")
49

50
        r.GET("/page/:uuid", func(c *gin.Context) {
51
                uuid := c.Param("uuid")                          // Get the UUID from the path
52
                userAgent := c.Request.UserAgent()               // Get the client User-Agent
53
                isMobile := isMobileUA(userAgent)                // Check whether the client is mobile
54
                templateName := "desktop.html"                   // Default desktop template
55
                if isMobile {                                    // Use the mobile template for mobile devices
56
                        templateName = "mobile.html"
57
                }
58
                // Render the template and pass the UUID (available as {{.UUID}})
59
                c.HTML(http.StatusOK, templateName, gin.H{"UUID": uuid})
60
        })
61

62
        // Register the login endpoint (POST /api/login)
63
        r.POST("/api/user", loginHandler)
64

65
        // Start the service (port: 30494)
66
        fmt.Println("Server running on http://localhost:30494")
67
        if err := r.Run(":30494"); err != nil {
68
                panic(fmt.Sprintf("Failed to start server: %v", err))
69
        }
70
}
71

72
// loginHandler handles login requests
73
func loginHandler(c *gin.Context) {
74
        // -------------------------- 1. Validate the Auth header --------------------------
75
        authHeader := c.GetHeader("Auth")
76
        if authHeader != fixedAuthBase64 {
77
                c.JSON(http.StatusUnauthorized, gin.H{
78
                        "code":    401,
79
                        "message": "Invalid Auth Header",
80
                })
81
                return
82
        }
83

84
        // -------------------------- 2. Parse and validate the request body --------------------------
85
        var req LoginRequest
86
        if err := c.ShouldBindJSON(&req); err != nil {
87
                c.JSON(http.StatusBadRequest, gin.H{
88
                        "code":    400,
89
                        "message": fmt.Sprintf("Invalid Request Body: %v", err),
90
                })
91
                return
92
        }
93

94
        // -------------------------- 3. Get client information --------------------------
95
        clientIP := getClientIP(c.Request)            // Client IP
96
        userAgent := c.Request.UserAgent()            // Client User-Agent
97
        serverTime := time.Now().Format(time.RFC3339) // Server time (RFC3339 format)
98

99
        // -------------------------- 4. Build the log entry --------------------------
100
        requestBody, err := json.MarshalIndent(req, "", "  ") // Format the request body
101
        if err != nil {
102
                c.JSON(http.StatusInternalServerError, gin.H{
103
                        "code":    500,
104
                        "message": fmt.Sprintf("Failed to Marshal Request Body: %v", err),
105
                })
106
                return
107
        }
108

109
        logEntry := fmt.Sprintf(
110
                "===== Request Log =====\n"+"IP: %s\nUA: %s\nServer Time: %s\nRequest Body:%s\n========================\n\n\n",
111
                clientIP, userAgent, serverTime, string(requestBody),
112
        )
113

114
        // -------------------------- 5. Write to the local log file --------------------------
115
        logFilePath := "./api_logs.txt" // Log-file path
116
        if err := appendToLogFile(logFilePath, logEntry); err != nil {
117
                c.JSON(http.StatusInternalServerError, gin.H{
118
                        "code":    500,
119
                        "message": fmt.Sprintf("Failed to Write Log: %v", err),
120
                })
121
                return
122
        }
123

124
        // -------------------------- 6. Return a success response --------------------------
125
        c.JSON(http.StatusOK, gin.H{
126
                "code":    200,
127
                "message": "Login request received and logged successfully",
128
                "data": gin.H{
129
                        "username": req.Username,
130
                },
131
        })
132
}
133

134
// getClientIP gets the real client IP, preferring X-Forwarded-For when proxied
135
func getClientIP(r *http.Request) string {
136
        // 1. Prefer the X-Forwarded-For header
137
        forwardedFor := r.Header.Get("X-Forwarded-For")
138
        if forwardedFor != "" {
139
                // Take the first IP in the proxy chain
140
                ips := strings.Split(forwardedFor, ",")
141
                if len(ips) > 0 {
142
                        return strings.TrimSpace(ips[0])
143
                }
144
        }
145

146
        // 2. Without a proxy, use RemoteAddr (format: IP:Port)
147
        ip, _, err := net.SplitHostPort(r.RemoteAddr)
148
        if err != nil {
149
                return r.RemoteAddr // Return the original value on error
150
        }
151
        return ip
152
}
153

154
// appendToLogFile appends data to the log file (thread-safe)
155
func appendToLogFile(filePath, content string) error {
156
        // Open the file: append | create if missing | write-only
157
        file, err := os.OpenFile(filePath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
158
        if err != nil {
159
                return err
160
        }
161
        defer file.Close() // Ensure the file is closed
162

163
        // Write the data
164
        _, err = file.WriteString(content)
165
        return err
166
}