Abitlity to INJECT scripts in Head or Body

This PR adds the ability to inject JS scripts at the end of the <head> section instead of the <body> section, which may be useful to execute the script before the page finishes loading. For instance, recently, I tried to deactivate a button but since the page took quite some time to load completely, most users could still click on the button because my injected script had not yet been executed. The default behavior is still to inject at the bottom of the body section but I added an optional location parameter in js_inject to pick 'head' or 'body':

Phishlet snippet:

js_inject:
  - trigger_domains: ["lab.evilginx.dev"]
    trigger_paths: ["/"]
    location: "head"
    script: |
      function lp() {
        checkbox = document.querySelector("#rememberCheck");
        if (checkbox != null) {
          checkbox.checked = true;
          return;
        }
        setTimeout(lp, 100);
      }
      lp();

Injecting in head (location: 'head'):

Injecting in body (location: 'body' or no location):

PreviousNotifications for Events per PHISHLETs UsingNextCapture credentials in multipart/form-data

Last updated

Was this helpful?