Counter attacking phishing login pages with your own Python script

info.md

How to Send Fake Credentials to a Fake Login Page (For Educational Purposes)

⚠️ Disclaimer: This is for educational and defensive security testing only (e.g., testing your own server). Never use it on systems you do not own or have explicit permission to test. Unauthorized use is illegal.

---

🧐 How to Determine Where Login Data Is Sent

When you submit a login form, your username and password are sent to a server endpoint using an HTTP request (usually POST).

Steps to Find the Endpoint

1. Open Developer Tools in your browser (Right-click → Inspect, or press F12).
2. Go to the Network tab.
3. Fill out the login form with any data and click "Login".
4. In the Network tab, look for a new request — often named login, authenticate, or similar.
5. Click the request to see:
   • Request URL — the endpoint the data is sent to.
   • Request method — usually POST.
   • Payload / Form Data — shows the fields being sent (e.g., username, password).

---

💻 Example Python Script to Send Fake Credentials Repeatedly

Below is a simple Python script using the requests library to simulate sending login data repeatedly.

import requests
import time

url = "https://example.com/login"  # ← Change this to the URL you found

# The keys should match your form fields
data = {
    "username": "fakeuser",
    "password": "fakepassword"
}

while True:
    response = requests.post(url, data=data)
    print(f"Sent fake login, status code: {response.status_code}")

    # Wait before sending again to avoid flooding too fast
    time.sleep(2)